CVE-2026-560226.9MediumCWE-308
CVE-2026-56022: Webmin MFA bypass
Vendor fix available · Affected: Webmin · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
0.6%probability of exploitation in the next 30 days
46th percentile
050100
Higher than 46% of scored CVEs
6.9MediumCVSS 3.1
LowMediumHighCrit.
DescriptionNVD
Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements. Fixed in 2.640.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 24 Jun.
- Critical Webmin flaws expose authentication bypass and data leaksSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.