CVE-2026-88895
Deferred Deferred - Pending Action

CyberPanel API Authentication Bypass via Password-Derived Tokens

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88895
EUVD
EUVD-2026-75445

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cyberpanel cyberpanel to 3.0.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88895 is an authentication bypass vulnerability in CyberPanel versions before 3.0.5. It allows attackers who obtain an administrator's password to derive API tokens and bypass two-factor authentication (TOTP) requirements on API endpoints. This enables unauthorized administrative operations or session creation without the second factor.

Detection Guidance

To detect this vulnerability, check CyberPanel versions before 3.0.5 by running: 'cyberpanel version' or 'apt list --installed | grep cyberpanel'. Inspect API endpoints for TOTP bypass attempts by monitoring logs for unusual administrative actions without TOTP codes. Look for derived API tokens in logs or database queries.

Impact Analysis

If exploited, this vulnerability could allow attackers to gain unauthorized administrative access to CyberPanel systems. They could perform administrative operations, create authenticated sessions, or manipulate system configurations without needing the second factor (TOTP code). This could lead to data breaches, system compromise, or further lateral movement within a network.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (health information). It undermines authentication controls, potentially resulting in non-compliance, legal penalties, or data exposure risks.

Mitigation Strategies

Immediately upgrade CyberPanel to version 3.0.5 or later. Rotate all API tokens and administrative passwords. Enforce TOTP for all API endpoints and review logs for unauthorized access attempts. Disable legacy token mechanisms if present.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88895. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart