CVE-2026-56022

🔶 medium

Summary

Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements. Fixed in 2.640.

CVSS Score

5.3

Medium

EPSS Score

0.6

Exploit Probability

Published Date

2026-06-18

First Seen: 2026-06-25

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 19.0% of all 365,987 vulnerabilities in our database.

#296,602

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Jun 24, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

Adem El Adeb, vulone.com/vul1.com

SSVC data provided by CISA

Last Modified 2026-08-11

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVSS Vector 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWE IDs (Weakness Types)

CWE-308

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
webmin	webmin	Affected	< 2.640

🔗 References 4

https://github.com/webmin/webmin/releases/tag/2.640

Release Notes

https://raw.githubusercontent.com/cisagov/CSAF/devel...

VDB Entry

https://webmin.com/security/#webmin-prior-to-2640

Vendor Advisory

https://www.cve.org/CVERecord?id=CVE-2026-56022

VDB Entry

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-56021	🔶 medium	5.3	0.5	Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due ...	2026-06-18
CVE-2026-22678	🔶 medium	5.4	0.2	Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the ...	2026-05-21
CVE-2025-67738	⚠️ high	8.5	0.4	squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module a...	2025-12-11
CVE-2025-61541	⚠️ high	7.1	0.1	Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset l...	2025-10-16
CVE-2024-12828	⚠️ high	8.8	21.7	Webmin CGI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ...	2024-12-30
CVE-2024-45692	⚠️ high	7.5	0.1	Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000.	2024-09-04

These CVEs affect the same products