CVE-2026-67614 CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminal
Attackers can forge JWT tokens using a hardcoded secret to gain unauthenticated root shell access via the WebTerminal service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-67614?
CVE-2026-67614 is a critical vulnerability in usmannasir cyberpanel, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed with the hardcoded secret value, specifying ssh_user=root, to authenticate to the terminal service without any valid credentials and receive a root shell.
Weakness: CWE-798
Which versions are affected by CVE-2026-67614?
How do I fix CVE-2026-67614?
No fix has been published for CVE-2026-67614 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-67614 being exploited?
There is no known exploitation of CVE-2026-67614 in the wild and no public exploit code.
Sources
Also known as GHSA-jr78-52g9-xcm6.