Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-56022: Webmin allows attackers to bypass additional login security
CVE-2026-56022 · published 4 months ago
Summary
The Webmin software does not properly verify user identities when an attacker uses a specific header. This could allow unauthorized access to the system. To fix this, update to Webmin version 2.641 or later.
What to do
- Update webmin webmin to version 2.640 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| webmin | webmin | < 2.640 |
Original advisory text
Webmin MFA bypass
Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements. Fixed in 2.640.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56022... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-56022 Vendor Advisory
- https://github.com/webmin/webmin/releases/tag/2.640 Vendor Advisory
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/... Vendor Advisory
- https://webmin.com/security/#webmin-prior-to-2640 Vendor Advisory
- https://github.com/webmin/webmin/releases/tag/2.641
- https://webmin.com/security/#webmin-prior-to-2641
- https://www.cve.org/CVERecord?id=CVE-2026-56022 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.8
High
Type
CWE-308Use of Single-factor Authentication
Timeline
Published18 Jun 2026
Updated4 Nov 2026
First seen22 Jun 2026
Track software like this
Free during beta