What’s Vulnerable › Vulnerabilities

CVE-2020-36948: VestaCP 0.9.8-26 - 'LoginAs' Insufficient Session Validation

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-27 · updated 2026-06-17
• Weakness: CWE-863

Description

VestaCP 0.9.8-26 contains a session token vulnerability in the LoginAs module that allows remote attackers to manipulate authentication tokens. Attackers can exploit insufficient token validation to access user accounts and perform unauthorized login requests without proper administrative permissions.

Affected products

• VestaCP: 0.9.8-26

References

• https://vestacp.com/
• https://www.exploit-db.com/exploits/49219
• https://www.vulncheck.com/advisories/vestacp-loginas-insufficient-session-validation
• https://www.vulnerability-lab.com/get_content.php?id=2240
• https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.
• https://www.exploit-db.com/exploits/49219
• https://www.vulnerability-lab.com/get_content.php?id=2240
• https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.

Get alerted when CVE-2020-36948 or the next vulnerability affects your stack