HIGH 8.6 NVD
CVE-2026-88895
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived token
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.
References
- https://github.com/usmannasir/cyberpanel/security/advisories/GHSA-h2f7-38ww-5pwc
- https://www.vulncheck.com/advisories/cyberpanel-before-3.0.5-authentication-bypass-via-api
This high severity vulnerability with a CVSS score of 8.6 was published on 2026-09-10 via NVD.
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.