CyberPanel (< 3.0.5) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/cyberpanel--3.0.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 10 Sep 2026 15:16:32 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCyberPanel Authentication Bypass via APIhttps://feed.craftedsignal.io/briefs/2026-09-cyberpanel-auth-bypass/Thu, 10 Sep 2026 15:16:32 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-cyberpanel-auth-bypass/CyberPanel versions prior to 3.0.5 contain an authentication bypass vulnerability where two-factor authentication is not enforced on API endpoints, allowing credential-derived token misuse.CyberPanel versions prior to 3.0.5 are vulnerable to an authentication bypass due to the failure to enforce two-factor authentication (TOTP) on API endpoints. An attacker who obtains an administrator's password can derive API tokens, effectively bypassing the second-factor requirement to execute administrative operations or establish unauthorized sessions. This vulnerability impacts the control plane of the CyberPanel environment, potentially allowing attackers to gain full administrative access to hosted web services and panel configurations. Defenders should prioritize patching to version 3.0.5 or later to restore TOTP integrity for all API-based authentication attempts.

Impact

Successful exploitation allows an attacker to bypass MFA protections and gain administrative access to CyberPanel. This leads to full administrative control over the panel, enabling configuration changes, service disruption, and access to all managed web content and databases.

Recommendation

  1. Patch all CyberPanel instances to version 3.0.5 or later immediately to enforce TOTP on API endpoints.
  2. Implement monitoring for anomalous API calls originating from administrative accounts that lack corresponding multi-factor authentication events in the audit logs.
  3. Audit current administrative sessions for signs of unauthorized access, specifically looking for token-based authentication patterns that deviate from standard browser-based login workflows.
]]>highadvisoryvulnerabilityauthentication-bypasscve-2026-88895