← Database

CVE-2026-56020

HIGH CVSS: 8.1 Published: 2026-06-18 Modified: 2026-08-11

Description

The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP header. A remote attacker can spoof certificate DNs and authenticate as any user. Fixed in 2.202.

Affected Platforms

Unknown

Weakness Type

CWE-290

References