CVE-2026-56022

Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements. Fixed in 2.641.

Scoring

Severity

MEDIUM

CVSS base score

6.9

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS probability

0.56%

CWE

CWE-308

Published

2026-06-18

Last modified

2026-08-11

Affected products

• Webmin Webmin
• Webmin Webmin
• Webmin Webmin

Weakness type

• CWE-308

Related vulnerabilities

• CVE-2026-58240 — Missing Authentication check in SAP NetWeaver (Message Server)
• CVE-2026-85590 — phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable
• CVE-2026-67611 — OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration
• CVE-2024-27928 — Vantage6: 2FA can be circumvented with hacked email access
• CVE-2026-45749 — Termix's TOTP two-factor authentication can be disabled or bypassed using only the account password
• CVE-2026-33550 — SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length...
• CVE-2025-64103 — Zitadel Bypass Second Authentication Factor
• CVE-2025-42959 — Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476

Markdown version · Browse all CVEs