CVE-2026-88895 — CyberPanel before 3.0.5 Authentication Bypass via API
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who …
Published: 2026-09-10 · CVSS: 8.6 · CVSS 4.0
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7