CVE-2026-56020 — Webmin HTTP header authentication bypass
The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP header. A remote …
Published: 2026-06-18 · CVSS: 9.2 · CVSS 4.0
The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP header. A remote attacker can spoof certificate DNs and authenticate as any user. Fixed in 2.202.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7