What’s Vulnerable › Vulnerabilities

CVE-2026-67614: CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminal

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-13 · updated 2026-10-24
• Weakness: CWE-798

Description

CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed with the hardcoded secret value, specifying ssh_user=root, to authenticate to the terminal service without any valid credentials and receive a root shell.

Affected products

• usmannasir cyberpanel: before 3.0.0 — fixed in 3.0.0

How to fix

Upgrade to a fixed version: usmannasir cyberpanel 3.0.0. Check the vendor advisory for mitigations.

References

• https://cyberpanel.net/KnowledgeBase/home/change-logs/
• https://github.com/usmannasir/cyberpanel/issues/1858
• https://www.vulncheck.com/advisories/cyberpanel-hard-coded-jwt-secret-authentication-bypass-via-webterminal

Get alerted when CVE-2026-67614 or the next vulnerability affects your stack