Skip to main content

CyberPanel CVE-2026-67614

| EUVDEUVD-2026-58129 CRITICAL
Use of Hard-coded Credentials (CWE-798)
2026-08-13 VulnCheck GHSA-jr78-52g9-xcm6
Authentication Bypass Cyberpanel
9.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.8 CRITICAL

Network-reachable service, no auth and no interaction due to the hard-coded secret (PR:N/UI:N/AC:L), and a root shell yields full C/I/A on the host; scope unchanged as the impact stays within the compromised system.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 13, 2026 - 18:04 EUVD
Analysis Generated
Aug 13, 2026 - 18:00 vuln.today
CVE Published
Aug 13, 2026 - 17:08 cve.org
CRITICAL 9.3

DescriptionCVE.org

CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed with the hardcoded secret value, specifying ssh_user=root, to authenticate to the terminal service without any valid credentials and receive a root shell.

AnalysisAI

Unauthenticated remote root compromise affects CyberPanel before 3.0.0 through a hard-coded JWT signing secret in the WebTerminal FastAPI SSH service. Because the secret is baked into the code, an attacker can mint a valid token specifying ssh_user=root and connect to the WebSocket terminal on TCP 8888 with no credentials, receiving a fully interactive root shell. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Discover exposed CyberPanel port 8888
Delivery
Forge JWT with hard-coded secret and ssh_user=root
Exploit
Open WebSocket to WebTerminal service
Execution
Authenticate with forged token
Persist
Receive interactive root shell
Impact
Full host and hosted-site compromise
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The only prerequisite is network reachability of the CyberPanel WebTerminal FastAPI SSH service on TCP port 8888 in a version before 3.0.0; exploitation uses a JWT forged with the application's hard-coded signing secret and the claim ssh_user=root, requiring no valid account, no user interaction, and no prior foothold. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This should be treated as a top-priority, drop-everything issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker scans the internet for CyberPanel hosts with TCP 8888 open, then uses the publicly known hard-coded JWT secret to sign a token containing ssh_user=root. They open a WebSocket to the WebTerminal service, present the forged token, and are dropped into an interactive root shell with no credentials required - from which they exfiltrate data, deploy malware, or pivot to every website the panel manages. …
Remediation Upgrade to CyberPanel 3.0.0 or later, which is the fixed release per the vendor change log (https://cyberpanel.net/KnowledgeBase/home/change-logs/); this is the primary and authoritative fix. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all CyberPanel installations to identify systems running versions prior to 3.0.0 and immediately restrict network access to port 8888 (WebTerminal service) to administratively-controlled networks only; evaluate disabling WebTerminal entirely if SSH terminal access is not operationally required. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Cyberpanel

View all
CVE-2024-51378 CRITICAL POC
9.8 Oct 29

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers t
CVE-2024-51567 CRITICAL POC
9.8 Oct 29

upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypas
CVE-2024-51568 CRITICAL POC
9.8 Oct 29

CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecut
CVE-2026-71966 HIGH POC
8.7 Aug 10

Command injection in CyberPanel 2.4.3's remote backup transfer feature allows authenticated low-privileged users to exec
CVE-2026-41473 HIGH POC
8.8 Apr 24

Unauthenticated database writes in CyberPanel versions before 2.4.4 allow remote attackers to abuse two AI Scanner worke
CVE-2024-53376 HIGH POC
8.8 Dec 16

CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the

CVE-2019-13056 HIGH POC
8.8 Jul 02

An issue was discovered in CyberPanel through 1.8.4. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
CVE-2026-71965 HIGH POC
8.7 Aug 10

Authenticated remote code execution in CyberPanel 2.4.3 allows any logged-in user to escalate to persistent root-level S
CVE-2021-47949 HIGH POC
8.7 May 10

CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files an
CVE-2026-71964 HIGH POC
7.1 Aug 10

Arbitrary file read in CyberPanel 2.4.3's file manager allows authenticated panel users to escape their home-directory s
CVE-2024-54679 MEDIUM POC
6.5 Dec 05

CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions. R
CVE-2026-41472 MEDIUM POC
5.3 Apr 24

Stored cross-site scripting in CyberPanel's AI Scanner dashboard chains to unauthenticated remote code execution on vers

Same weakness CWE-798 – Use of Hard-coded Credentials

View all
CVE-2016-1560 CRITICAL POC
9.8
CVE-2017-14143 CRITICAL POC
9.8
CVE-2026-22769 CRITICAL
10.0
CVE-2016-5678 CRITICAL POC
9.8
CVE-2017-6558 CRITICAL POC
9.8
CVE-2015-7246 CRITICAL POC
9.8
CVE-2015-4667 CRITICAL POC
9.8
CVE-2016-10177 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-67614 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy