CVE-2026-88895
HIGH
NVD
CVSS Score
7.2
Severity
HIGH
Published
Sep 10, 2026
Vendor
unknown
Description
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.