CyberPanel EUVD-2026-75445

Exploitation requires the attacker to already possess the target administrator's password - this is the primary gating condition. The vulnerability is only meaningful when 2FA/TOTP is enabled on the administrator account, since the bypass is only relevant if the second factor would otherwise be enforced. The attack targets CyberPanel API endpoints specifically; the web UI login flow may independently enforce TOTP. The CVSS PR:H metric confirms high-privilege credentials are required. Exploitation is not possible without the administrator password; unauthenticated attackers or those with only user-level credentials cannot leverage this bypass. There is no requirement for physical access, special network position, or non-default configuration beyond having 2FA enabled.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, score 8.6) correctly reflects that administrator-level credentials are a prerequisite (PR:H), meaning this vulnerability is not useful to an unauthenticated attacker starting from zero. The real-world impact, however, is significant: the entire value proposition of enabling 2FA - protecting against password-only compromise scenarios such as credential stuffing, phishing, or breach replay - is negated at the API layer. Organizations that deployed 2FA on CyberPanel admin accounts specifically to guard against those threats receive no protection. No KEV listing and no confirmed POC availability were identified, so exploitation is not yet confirmed as active or widespread. EPSS data was not provided in the input. The practical exploitation window requires prior credential compromise, which limits the immediacy of the threat compared to a fully unauthenticated vulnerability, but the impact once triggered is full administrative compromise.

An attacker who acquires a CyberPanel administrator's password through phishing, credential stuffing, or a separate breach uses the known token derivation algorithm to compute a valid API token directly from the password. They then issue authenticated API calls to CyberPanel's administrative endpoints - creating new admin accounts, modifying DNS or hosting configurations, or deploying malicious code - without ever satisfying the TOTP prompt that would otherwise protect the account. No public POC has been confirmed, but the token derivation process is described in sufficient detail in the VulnCheck advisory to be reproducible.