High severity7.2NVD Advisory· Published Sep 10, 2026· Updated Sep 10, 2026

CVE-2026-88895

Description

CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.

Affected products

Cyberpanel/Cyberpanelllm-fuzzy2 versions
<3.0.5+ 1 more
- (no CPE)range: <3.0.5
- (no CPE)range: <3.0.5

Patches

Vulnerability mechanics

References

github.com/usmannasir/cyberpanel/security/advisories/GHSA-h2f7-38ww-5pwcnvd
www.vulncheck.com/advisories/cyberpanel-before-3.0.5-authentication-bypass-via-apinvd

News mentions

No linked articles in our index yet.

cvss	0.468
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000