Authentication Bypass in Webmin Affects Unix-like Servers
CVE-2026-42210

5.3MEDIUM

Key Information:

Vendor

Webmin

Status
Webmin
Vendor
CVE Published:
20 July 2026

What is CVE-2026-42210?

Webmin, a web-based system administration tool for Unix-like servers, has a vulnerability that allows an attacker who possesses the username and password to bypass the two-factor authentication (2FA) requirement using Basic authentication. This weakness is particularly concerning for accounts that are meant to enhance security through an additional authentication factor, such as Time-based One-Time Password (TOTP). To mitigate this vulnerability, users are advised to apply the patch from commit da18a16c84ae5c0b78cad79609cb0efb174000ec manually to secure their Webmin installations.

Affected Version(s)

webmin < 2.640

References

https://github.com/webmin/webmin/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/webmin/webmin/commit/da18a16c84ae5c0b7...
x_refsource_MISC

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.