CVE-2026-88895— CyberPanel before 3.0.5 Authentication Bypass via API
Quick assessment
Affected
usmannasir cyberpanel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
CyberPanel 在 3.0.5 版本之前，未能强制在 API 端点实施双因素认证，使得攻击者能够利用基于密码生成的令牌来绕过 TOTP（基于时间的一次性密码）要求。攻击者一旦获取管理员的密码，即可推导出 API 令牌，从而无需第二因素即可执行管理操作或创建已认证的会话。
Possible ATT&CK Techniques 2 AI
T1556.001 · Domain Controller Authentication T1556.002 · Password Filter DLL
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-88895
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CyberPanel before 3.0.5 Authentication Bypass via API
Source: CVE Program / CVE List V5
Vulnerability Description
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| usmannasir | cyberpanel | 0 ~ 3.0.5 | - |
|
II. Public POCs for CVE-2026-88895
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-88895
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-88895 (2)
-
-
🔗 CyberPanel before 3.0.5 Authentication Bypass via API | Advisories | VulnCheck third-party-advisory
IV. Related Vulnerabilities
Same product: cyberpanel
-
CVE-2026-87820
CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI -
CVE-2026-67613
CyberPanel < 3.0.0 Path Traversal File Read via cloudAPI Rea -
CVE-2026-67614
CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypa -
CVE-2026-71966
CyberPanel 2.4.3 Authenticated Command Injection via starRem -
CVE-2026-71965
CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature
Same vendor: usmannasir
-
CVE-2026-87820
CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI -
CVE-2026-67613
CyberPanel < 3.0.0 Path Traversal File Read via cloudAPI Rea -
CVE-2026-67614
CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypa -
CVE-2026-71966
CyberPanel 2.4.3 Authenticated Command Injection via starRem -
CVE-2026-71965
CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature
Same weakness: CWE-287
-
CVE-2026-88018
rclone serve s3: --auth-proxy without --auth-key authenticat -
CVE-2026-88007
Traefik HTTP/3 Backend NTLM Connection Reuse -
CVE-2026-47156
MantisBT: SOAP API Authentication Bypass with Privilege Esca -
CVE-2026-87806
Parse Server 9.0.0 Authentication Bypass via LDAP Empty Pass -
CVE-2026-79974
Dell SCG 5.0 特定版本身份认证不当漏洞
V. Comments for CVE-2026-88895
No comments yet