CVE-2026-88895CWE-287

CVE-2026-88895

High · published September 10, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
50.7
In the wild
Unconfirmed
What it is

CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00652 · 50.7th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-09-10T18:17Z
References (2)
https://github.com/usmannasir/cyberpanel/security/advisories/GHSA-h2f7-38ww-5pwc · [email protected]https://www.vulncheck.com/advisories/cyberpanel-before-3.0.5-authentication-bypass-via-api · [email protected]
EPSS history
Timeline
  • 12 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 10 SEP 13:05Z
    CyberPanel before 3.0.5 Authentication Bypass via API
    cvelistv5