CVE-2026-42210CWE-287

Webmin 2FA requirement bypass

Medium · published July 20, 2026

CVSS v4.0
5.3
EPSS
1%
Percentile
43.4
In the wild
Unconfirmed
What it is

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor (typically TOTP), an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication. Webmin is a web-based system administration tool for Unix-like servers. As a workaround, apply the patch from commit da18a16c84ae5c0b78cad79609cb0efb174000ec manually.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00521 · 43.4th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-07-20T17:03Z
EPSS history
Timeline
  • 20 JUL 17:03Z
    Webmin 2FA requirement bypass
    cvelistv5