CVE-2026-88895: CyberPanel before 3.0.5 Authentication Bypass via API

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-10 · updated 2026-09-11
Weakness: CWE-287

Description

CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.

Affected products

usmannasir cyberpanel: before 3.0.5 — fixed in 3.0.5

How to fix

Upgrade to a fixed version: usmannasir cyberpanel 3.0.5. Check the vendor advisory for mitigations.

References

https://github.com/usmannasir/cyberpanel/security/advisories/GHSA-h2f7-38ww-5pwc
https://www.vulncheck.com/advisories/cyberpanel-before-3.0.5-authentication-bypass-via-api

Get alerted when CVE-2026-88895 or the next vulnerability affects your stack