CVE-2026-88895 in CyberPanel
Summary
by MITRE • 09/10/2026
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability in CyberPanel versions prior to 3.0.5 represents a critical authentication control failure that undermines the security posture of systems relying on two-factor authentication for privileged access. Specifically, the application fails to enforce time-based one-time password requirements when authenticating against its API endpoints. This architectural flaw allows an attacker who has obtained an administrator's static credentials, such as a username and password, to bypass the intended multi-layered defense mechanism. By exploiting this gap, attackers can derive valid API tokens directly from the compromised password without needing access to the user's second factor device or authenticator application.
From a technical perspective, the flaw stems from improper implementation of authentication logic within the API layer. While the web interface correctly prompts for and validates TOTP codes during login, the underlying API endpoints do not perform this additional verification step before issuing session tokens or executing administrative commands. This inconsistency creates an attack vector where static credentials are treated as sufficient proof of identity for programmatic access. Consequently, any individual with knowledge of the administrator's password can generate valid authentication tokens that grant full administrative privileges within the CyberPanel environment.
The operational impact of this vulnerability is severe, particularly in environments where CyberPanel manages web hosting services or server configurations. An attacker leveraging this flaw can perform a wide range of unauthorized actions including creating new user accounts, modifying DNS records, accessing sensitive configuration files, and potentially deploying malicious code on the hosted servers. Since API tokens often persist for extended periods, the compromise is not limited to immediate access but may allow for persistent backdoor entry into the system even after the initial password breach has been detected and changed if existing sessions are not properly invalidated.
This vulnerability aligns with CWE-287 Improper Authentication as it involves a failure in verifying identity through all required factors. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, where adversaries use legitimate credentials to gain access without triggering typical intrusion detection alerts associated with brute force or credential stuffing attacks. The ability to bypass MFA via API endpoints is particularly dangerous because it allows attackers to automate their exploitation using scripts and tools that interact directly with the application programming interface rather than through a graphical user interface.
Mitigation strategies should prioritize immediate upgrading of CyberPanel to version 3.0.5 or later where this authentication logic has been corrected to enforce TOTP validation across all entry points including API endpoints. In cases where an upgrade is not immediately feasible, administrators should implement network-level controls such as restricting API access to trusted IP addresses using firewall rules or reverse proxy configurations. Additionally enabling comprehensive logging and monitoring for administrative actions can help detect unauthorized usage patterns resulting from compromised credentials. Organizations must also enforce strict password policies and consider implementing additional layers of security such as certificate-based authentication for critical systems to reduce reliance on single-factor passwords even if MFA is bypassed through other means.