Skip to content
OpenAdvisories
High VA-26-169-02 3 CVEs

Webmin multiple vulnerabilities

Published Jun 18, 2026 · Updated Aug 11, 2026 · Revision 2

Vendor: Webmin Product: Webmin

Summary

Webmin contains multiple vulnerabilities. In the worst case, a remote, unauthenticated attacker could impersonate and authenticate as any user.

Vulnerabilities 3

  • High 8.1
    CVE-2026-56020

    Webmin HTTP header authentication bypass

    The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP header. A remote attacker can spoof certificate DNs and authenticate as any user. Fixed in 2.202.

    Webmin Webmin
  • Medium 5.3
    CVE-2026-56021

    Webmin information disclosure via regex pattern

    Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.

    Webmin Webmin
  • Medium 5.3
    CVE-2026-56022

    Webmin MFA bypass

    Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements. Fixed in 2.640.

    Webmin Webmin

Revision history

  1. #2.0.0

    Content Update

  2. #1.0.0

    Initial publication