Authentication Bypass Flaw in CyberPanel WebTerminal by CyberPanel
CVE-2026-67614

9.3CRITICAL

Key Information:

Vendor

Usmannasir

Status
Cyberpanel
Vendor
CVE Published:
13 August 2026

What is CVE-2026-67614?

A security vulnerability in CyberPanel prior to version 3.0.0 poses a significant threat as it harbors a hard-coded JWT secret within the WebTerminal FastAPI SSH service. This flaw permits unauthenticated attackers to generate legitimate authentication tokens. By exploiting this vulnerability, attackers can gain interactive root shell access through WebSocket on port 8888 by using a crafted JWT signed with the embedded secret, allowing them to authenticate without any credentials as the root user. This vulnerability underscores the critical importance of securing authentication mechanisms.

Affected Version(s)

cyberpanel 0

References

https://cyberpanel.net/KnowledgeBase/home/change-logs/
release-notes
https://github.com/usmannasir/cyberpanel/issues/1858
https://www.vulncheck.com/advisories/cyberpanel-hard-code...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Deniz Mert
.