Webmin EUVD-2026-37907

Exploitation requires two concrete preconditions: first, the attacker must possess valid Webmin credentials (username and password) for an account on the target instance - the vulnerability bypasses MFA only, not the initial credential check; second, MFA must be enabled on the Webmin instance, as the bypass specifically circumvents the second-factor enforcement path. The triggering condition is the HTTP header 'User-Agent: webmin' in a basic authentication request. Exploitation is limited by: the need for prior credential knowledge (phishing, breach, or insider access); the requirement that the target Webmin port be network-reachable; and the assumption that MFA was the sole compensating control layered on top of those credentials. Instances behind a VPN or IP allowlist with no internet-exposed Webmin port face significantly reduced exposure.

The official NVD CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) substantially understates real-world risk. The PR:N assignment conflicts with the description: basic authentication credentials (username and password) are still required to exploit this bypass - the bypass is specifically of the MFA second factor, not of the credential check itself. This makes PR:L a more accurate representation. Furthermore, C:N/I:L/A:N ignores what authenticated Webmin access actually enables: full OS-level command execution, file management, user administration, and service control. The EPSS score is not available in the provided data. No CISA KEV listing exists, and no public POC has been identified, making widespread opportunistic exploitation less likely at this time. The SSVC technical impact, however, is total once a threat actor with valid credentials successfully exploits this - CISA-CG involvement as the reporter suggests the agency assessed this as a meaningful risk to managed infrastructure. The more accurate risk framing is: any attacker who has compromised or phished a Webmin account but is stopped by MFA can now bypass that control, fully negating the MFA deployment investment.

An attacker who has obtained valid Webmin credentials through phishing, credential stuffing, or a prior breach attempts login but is stopped by the MFA prompt. The attacker replaces their browser's User-Agent with 'webmin' - trivially done via any HTTP client such as curl - and resubmits the basic auth request, which Webmin accepts without invoking the MFA challenge, granting full administrative access to the server. No public POC has been identified at time of analysis, but the technique requires only standard HTTP tooling and knowledge of the header value.