high7.2
CVE-2026-88895
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived toke…
Impact
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.
Affected products
| Product | Affected versions |
|---|---|
| CyberPanel | before 3.0.5 |
Versions were read from the advisory text. No structured product data has been published for this record yet.