CVE-2026-88895

CyberPanel before 3.0.5 fails to enforce two-factor authentication (TOTP) on its API endpoints, an improper authentication flaw (CWE-287). An attacker who has already obtained an administrator's password can derive API tokens from that password and perform administrative operations or create authenticated sessions without supplying the second factor. This defeats the protection TOTP is supposed to provide for the admin account, yielding high-impact administrative access to the hosting panel (CVSS 4.0 rates confidentiality, integrity, and availability impacts as high). Any CyberPanel deployment running a version earlier than 3.0.5 is affected, particularly instances whose administrators enabled TOTP believing the admin account was protected. No exploitation is currently known: the flaw is not in CISA KEV and no public proof-of-concept has been published.

What to do: Upgrade to CyberPanel 3.0.5 or later as soon as possible. Until patched, restrict access to the panel and its API to trusted networks (firewall/allowlist/VPN), rotate admin credentials if compromise is suspected, and treat the admin password as the sole factor for API access since TOTP is not enforced there. Review API and authentication logs for token-derived or administrative activity that did not involve a second factor.