← Database

CVE-2026-56022

MEDIUM CVSS: 5.3 Published: 2026-06-18 Modified: 2026-08-11

Description

Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements. Fixed in 2.640.

Affected Platforms

Webmin Webmin

Weakness Type

CWE-308

References