EUVD-2026-46035Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L because valid credentials are required; S:C and C/I/A:H because Webmin admin access yields full OS-level command execution.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor (typically TOTP), an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication. Webmin is a web-based system administration tool for Unix-like servers. As a workaround, apply the patch from commit da18a16c84ae5c0b78cad79609cb0efb174000ec manually.
AnalysisAI
Two-factor authentication bypass in Webmin prior to version 2.640 allows a network attacker holding valid username and password credentials to gain full administrative access by sending requests via the HTTP Basic authentication code path, which skips TOTP enforcement entirely. All Unix-like systems running Webmin with 2FA enabled on any account are affected, making this particularly dangerous in environments where 2FA was deployed as the primary compensating control against credential exposure. No active exploitation has been confirmed via CISA KEV, and no public exploit code was identified in the provided data at time of analysis.
Technical ContextAI
Webmin (CPE: cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*) is a Perl-based web administration interface for Unix-like systems, exposing server management functions - file editing, user administration, service control, and shell execution - through a browser on TCP port 10000. The root cause is CWE-287 (Improper Authentication): the HTTP Basic authentication handler in WebminCore.pm validates only the first factor (username and password) without checking whether the account requires a second factor (TOTP). The fix commit da18a16c84ae5c0b78cad79609cb0efb174000ec modifies WebminCore.pm to enforce 2FA even when Basic auth is used, confirming the bypass exists in the authentication dispatch logic rather than in any cryptographic component. This is a logic flaw - the 2FA gate is simply never reached on the Basic auth code path.
RemediationAI
Upgrade Webmin to version 2.640 or later, which incorporates the fix from commit da18a16c84ae5c0b78cad79609cb0efb174000ec (https://github.com/webmin/webmin/commit/da18a16c84ae5c0b78cad79609cb0efb174000ec). If an immediate upgrade is not possible, the vendor advisory at https://github.com/webmin/webmin/security/advisories/GHSA-qpww-fff2-6fgv explicitly documents applying that patch commit manually as a supported workaround. As a network-level compensating control, restrict access to the Webmin port (typically TCP 10000) via firewall rules to allow only trusted IP ranges - this does not eliminate the vulnerability but eliminates internet-facing exposure, the primary attack surface. If Webmin's configuration allows disabling HTTP Basic authentication as an accepted login method, doing so would directly neutralize the bypass vector, though this may break automated integrations or scripts that rely on Basic auth and should be tested before deployment.
An issue was discovered in Webmin <=1.920. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitabl
file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid
file/edit_html.cgi in Webmin 1.590 and earlier does not perform an authorization check before showing a file's unedited
software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command. Rated critical severity (CVSS 9.8), thi
Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990. Rated high severity
In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root pr
SSRF exists in Webmin 1.850 via the PATH_INFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/h
Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Dow
Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's ru
CSRF exists in Webmin 1.850. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authenticati
Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually creat
Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to create a privileged user through Webmin's add users fea
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today