Which versions of Webmin are affected by EUVD-2026-37909?

A critical authentication bypass in Webmin's HTTP server allows remote attackers to impersonate administrators and gain system management access without valid credentials.. A patch is available.

How to fix or mitigate EUVD-2026-37909?

Within 24 hours: Identify all systems running Webmin versions prior to 2.641 and restrict network access to the Webmin interface where operationally feasible. Within 7 days: Deploy vendor-released patch version 2.641 to all affected Webmin instances. Within 30 days: Verify patch deployment completion and conduct post-remediation validation of all upgraded systems.

Webmin EUVD-2026-37909

Q: What is the CVSS score of EUVD-2026-37909?

EUVD-2026-37909 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-56020 CRITICAL

Authentication Bypass by Spoofing (CWE-290)

2026-06-18 cisa-cg

GHSA-23xj-gfh3-wf2h

Authentication Bypass Webmin

9.2

CVSS 4.0 · Vendor: cisa-cg

Severity by source

Vendor (cisa-cg) PRIMARY

9.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable miniserv.pl with no auth or user interaction (AV:N/PR:N/UI:N); AC:H because target must be configured for SSL client-cert auth, a non-default precondition; full admin compromise yields C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cisa-cg).

CVSS VectorVendor: cisa-cg

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 18, 2026 - 19:44 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 18, 2026 - 19:44 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 18, 2026 - 19:38 vuln.today

cvss_changed

Severity Changed

Jun 18, 2026 - 19:38 NVD

HIGH CRITICAL

CVSS changed

Jun 18, 2026 - 19:38 NVD

8.1 (HIGH) 9.2 (CRITICAL)

Patch available

Jun 18, 2026 - 19:01 EUVD

Source Code Evidence Fetched

Jun 18, 2026 - 17:02 vuln.today

Analysis Generated

Jun 18, 2026 - 17:02 vuln.today

DescriptionCVE.org

The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP header. A remote attacker can spoof certificate DNs and authenticate as any user. Fixed in 2.641.

AnalysisAI

Authentication bypass in Webmin's miniserv.pl HTTP server (versions prior to 2.641) allows remote unauthenticated attackers to impersonate any user, including root/admin, by sending a forged HTTP header that spoofs an SSL client certificate Distinguished Name. The flaw maps to CWE-290 (Authentication Bypass by Spoofing) and is rated CVSS 4.0 9.2 (Critical); a vendor-released fix exists in 2.641, but no public exploit is identified at time of analysis and the issue is not currently listed in CISA KEV.

Technical ContextAI

Webmin is a widely deployed Perl-based web administration interface for Unix-like systems, and miniserv.pl is its bundled mini HTTP/HTTPS server that handles authentication for the admin UI. The vulnerability is rooted in CWE-290: when Webmin is configured to accept SSL client-certificate authentication, miniserv.pl trusts an HTTP request header that conveys the client certificate Distinguished Name rather than deriving the DN exclusively from the TLS-validated peer certificate. Because the header is attacker-controllable on the wire, a forged value is accepted as a legitimate identity. The 2.641 release notes mention 'Add support for trusted proxy IP addresses,' which is the architectural mitigation: only honor the spoofable header when the request originates from an explicitly trusted upstream proxy, matching how Apache/nginx handle X-Forwarded-* style headers.

RemediationAI

Vendor-released patch: upgrade to Webmin 2.641 or later, available at https://github.com/webmin/webmin/releases/tag/2.641 with vendor notes at https://webmin.com/security/#webmin-prior-to-2641. The fix introduces support for trusted proxy IP addresses so that the client-certificate DN header is only honored when the request demonstrably arrives from a configured trusted upstream. As a compensating control until patching, disable SSL client-certificate authentication in the Webmin Configuration > Authentication module and revert to password (with 2FA) authentication - this fully neutralizes the bypass but removes cert-based SSO for any users who depended on it. Alternatively, place Webmin behind a reverse proxy or firewall that strips or overwrites the spoofable certificate-DN header from any client-originated request, and restrict miniserv.pl's listening port (default 10000/tcp) to management VLANs or VPN ranges only; this preserves cert auth but adds operational complexity and a misconfiguration risk if the header name is not correctly enumerated.