CyberPanel before 3.0.5 Authentication Bypass via API
Priority MEDIUM 40CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.
Summary
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00652 51st percentileScored 2026-11-07
Fix Fixed cyberpanel (usmannasir): 3.0.5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| usmannasir | cyberpanel | before 3.0.5 | 3.0.5 | Patch available | CNA |
- cyberpanel Vendorusmannasir Affected before 3.0.5 Fixed in 3.0.5 Patch available CNA
Remediation
- Fix · CNA cyberpanel (usmannasir) Fixed in 3.0.5
Timeline
- 2026-10-02 Threatist record created from CVE-2026-88895
- 2026-10-03 Alias added: GHSA-mmcx-mj26-p5c9
- 2026-10-14 EPSS moved to the 50th–90th percentile
References
More usmannasir vulnerabilities
- TI-2026-50261 CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfer CVSS 4.0HIGH 8.7
- TI-2026-46955 CyberPanel IncBackups IDOR via Sequential Backup ID CVSS 4.0HIGH 8.7
- TI-2026-46954 CyberPanel Missing Authorization in cancelBackupCreation Handler CVSS 4.0HIGH 7.2
- TI-2026-50259 CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Upload CVSS 4.0HIGH 7.1
- TI-2026-47768 CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminal CVSS 4.0CRITICAL 9.3
- TI-2026-50260 CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature CVSS 4.0HIGH 8.7
Sources
- CVE-2026-88895 · CVE Program
- CVE-2026-88895 · NVD
- FIRST EPSS
- GHSA-mmcx-mj26-p5c9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences