Webmin EUVD-2026-46035

Exploitation requires that the attacker already possess a valid Webmin username and password for an account that has 2FA enabled - the bypass circumvents only the second factor, not the first. Accounts without 2FA configured are not affected by this specific flaw (though they have no second-factor protection regardless). The Webmin web interface must be network-accessible from the attacker's position on the standard port (typically TCP 10000). No non-default configuration is required beyond the presence of a 2FA-enabled account, meaning any default Webmin deployment that has enabled 2FA for one or more users is vulnerable. The key limiting factor is the hard prerequisite of valid first-factor credentials - this vulnerability cannot be used to bypass authentication entirely from a zero-knowledge starting point, and cannot be combined with brute force alone without first compromising credentials through another channel.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) correctly captures that valid credentials are required (PR:L) and no user interaction is needed, but the impact metrics (VC:N/VI:L/VA:N) significantly understate real-world consequence: successful 2FA bypass in Webmin yields unrestricted access to a server administration panel capable of remote command execution, file system modification, and user management on the underlying OS. The attack is automatable (AT:N confirmed) and requires no special technical conditions beyond network access and valid credentials, meaning credential-stuffing campaigns could exploit this at scale against internet-exposed instances. No EPSS score was provided in the input data. The absence of a CISA KEV entry and public exploit code suggests exploitation has not yet been observed at scale, but the trivial attack complexity makes this a high-priority patch target for any organization that has deployed Webmin with 2FA as a security boundary. The disconnect between the stated CVSS 4.0 impact and actual post-exploitation capability should be noted by defenders.

An attacker who obtained Webmin credentials through phishing, prior breach, or credential stuffing sends an HTTP GET or POST request to the target Webmin interface (e.g., https://target:10000/session_login.cgi) with an Authorization: Basic header encoding the compromised username and password, skipping the web form login flow entirely. WebminCore.pm grants a fully authenticated administrative session without prompting for the TOTP second factor. The attacker then has unrestricted access to execute shell commands, read arbitrary files, and modify system configuration on the underlying server. No public proof-of-concept code was identified in the provided data, but the technique is a straightforward HTTP header manipulation requiring no specialized tooling.