SecurityOnlineDo Son
Critical Webmin flaws expose authentication bypass and data leaks
Part of the CVE-2026-56020 story · since 24 Jun
- Wed 24 Jun, 02:01 UTC. SecurityOnline, first report. Critical Webmin flaws expose authentication bypass and data leaks. This article, 1st of 1.
A critical security alert highlights four active exploits detected today, specifically targeting vulnerabilities in the Webmin application. Key vulnerabilities include:
1. **CVE-2026-56020**: A critical HTTP header authentication bypass (CVSS 9.2) that allows attackers to impersonate users.
2. **CVE-2026-56021**: An information disclosure risk via regex pattern (CVSS 6.9) allowing unauthenticated access to configuration files.
3. **CVE-2026-56022**: A multi-factor authentication (MFA) bypass (CVSS 6.9).
Webmin has released version 2.641 with patches available to address these issues. No confirmed exploitations have been reported so far. Users are advised to update their systems to the latest version to secure against these vulnerabilities.
How the story developed
1 article from 1 outlet since 24 Jun. Quiet since 24 Jun. This was the first report.
- Wed 24 Jun, 02:01 UTC. SecurityOnline, first report. Critical Webmin flaws expose authentication bypass and data leaks. This article, 1st of 1.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 1 articles as a listHide the list
- Wed 24 JunDay 01
- Critical Webmin flaws expose authentication bypass and data leaks02:01 · SecurityOnline · First report · This article, 1st of 1