Authentication Bypass Vulnerability in CyberPanel by Usman Nasir

CVE-2026-88895

What is CVE-2026-88895?

CyberPanel, a web hosting control panel, prior to version 3.0.5 exposes a critical flaw in its API authentication process. The software's failure to properly enforce two-factor authentication allows attackers to exploit this vulnerability by bypassing the Time-based One-Time Password (TOTP) requirement. By leveraging an administrator's compromised password, attackers can derive API tokens and gain unauthorized access to administrative functions. This risk facilitates the creation of authenticated sessions without the necessary second factor of authentication, posing significant security threats to users and their data.

References