CVE-2026-42210
Received Received - Intake

Authentication Bypass in Webmin via Basic Auth

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor (typically TOTP), an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication. Webmin is a web-based system administration tool for Unix-like servers. As a workaround, apply the patch from commit da18a16c84ae5c0b78cad79609cb0efb174000ec manually.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-42210
EUVD
EUVD-2026-46035

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
webmin webmin to 2.640 (exc)
webmin webmin to 2.630 (exc)
webmin webmin 2.640

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Webmin versions before 2.640 allows attackers with valid username and password to bypass two-factor authentication (2FA) by using Basic authentication instead of the required second factor like TOTP.

Detection Guidance

To detect this vulnerability, check if Webmin is running a version prior to 2.640. Use commands like 'dpkg -l | grep webmin' on Debian-based systems or 'rpm -qa | grep webmin' on RPM-based systems to verify the installed version.

Impact Analysis

An attacker could gain unauthorized access to Webmin accounts even if 2FA is enabled, potentially allowing them to control the server or access sensitive data.

Compliance Impact

This vulnerability allows attackers to bypass two-factor authentication (2FA) for Webmin accounts by using Basic authentication, potentially enabling unauthorized remote access. For compliance with standards like GDPR and HIPAA, which require strong authentication and access controls, this bypass could lead to unauthorized data access or breaches, violating security requirements and increasing legal and regulatory risks.

Mitigation Strategies

Immediately update Webmin to version 2.640 or later. If updating is not possible, apply the patch from commit da18a16c84ae5c0b78cad79609cb0efb174000ec manually as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-42210. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart