CVE-2026-88895: CyberPanel before 3.0.5 Authentication Bypass via API
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
CyberPanel deployments running versions before 3.0.5 are affected when an administrator account uses TOTP-based two-factor authentication. The exposed API endpoints can be reached over the network.
What does an attacker need to exploit it?
An attacker needs to obtain an administrator's password. They can then derive password-based API tokens and bypass the administrator's TOTP requirement to perform administrative actions or create an authenticated session.
Does enabling TOTP prevent this attack?
No. The affected versions do not enforce TOTP on API endpoints, so TOTP does not stop an attacker who has an administrator password from using the password-derived token path.
What should be done if an administrator password may have been exposed?
Change the affected administrator password and investigate for unauthorized administrative operations or newly created authenticated sessions. Upgrade CyberPanel to version 3.0.5 or later to address the API TOTP enforcement issue.