Is CVE-2026-42210 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42210 being exploited in the wild.

How severe is CVE-2026-42210?

Informational severity, with a CVSS score of 5.3, published 20 July 2026.

Is there a fix for CVE-2026-42210?

A patch was published on 2026-04-15: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42210 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-42210?

Check whether you run Webmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42210: Webmin 2FA bypass via Basic authentication

CVE-2026-42210 · Severity: info · CVSS 5.3 · Published 2026-07-20

Webmin is a web-based interface used to manage Unix-like servers. A security flaw allows an attacker who already knows a user's password to bypass two-factor authentication (2FA) by using a specific type of login method (Basic authentication). This effectively reduces the security of the system to a single password, making it easier for unauthorized individuals to gain administrative access to the server.

Technologies: Webmin. Vendors: Webmin.

Quick answers

Is CVE-2026-42210 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42210 being exploited in the wild.
How severe is CVE-2026-42210?: Informational severity, with a CVSS score of 5.3, published 20 July 2026.
Which products and versions are affected?: Webmin < 2.640.
Is there a fix for CVE-2026-42210?: A patch was published on 2026-04-15: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42210 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42210?: Check whether you run Webmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass vulnerability exists in Webmin's handling of RPC and Basic authentication. For accounts configured to require a second factor (such as TOTP), the system fails to enforce this requirement when the client authenticates via HTTP Basic authentication. An attacker with knowledge of a valid username and password can bypass the 2FA challenge entirely. The root cause is located in the authentication logic within the miniserv component, specifically affecting how RPC calls validate session requirements. The issue is resolved in version 2.640; a manual patch is available for older versions.

Affected products

Webmin Webmin < 2.640

Timeline

2026-04-15: patched: Fix committed to repository
2026-05-16: advisory: GitHub security advisory published
2026-07-20: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.