CVE-2026-88895 CyberPanel before 3.0.5 Authentication Bypass via API
Attackers with admin passwords can bypass two-factor authentication on API endpoints to perform administrative operations or create sessions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-88895?
CVE-2026-88895 is a high-severity authentication bypass vulnerability in usmannasir cyberpanel, published on 10 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.
Weakness: CWE-287
Which versions are affected by CVE-2026-88895?
How do I fix CVE-2026-88895?
No fix has been published for CVE-2026-88895 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-88895 being exploited?
There is no known exploitation of CVE-2026-88895 in the wild and no public exploit code.
Sources
Also known as GHSA-mmcx-mj26-p5c9.