CVE-2026-67614CWE-798hardcoded-credentials

CVE-2026-67614

Critical · published August 13, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
61.3
In the wild
Unconfirmed
What it is

CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed with the hardcoded secret value, specifying ssh_user=root, to authenticate to the terminal service without any valid credentials and receive a root shell.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00964 · 61.3th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-08-13T22:18Z
References (3)
https://cyberpanel.net/KnowledgeBase/home/change-logs/ · [email protected]https://github.com/usmannasir/cyberpanel/issues/1858 · [email protected]https://www.vulncheck.com/advisories/cyberpanel-hard-coded-jwt-secret-authentication-bypass-via-webterminal · [email protected]
EPSS history
Timeline
  • 13 AUG 17:08Z
    CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminal
    cvelistv5