Executive brief
Webmin is a web-based interface used to manage Unix-like servers. A security flaw allows an attacker who already knows a user's password to bypass two-factor authentication (2FA) by using a specific type of login method (Basic authentication). This effectively reduces the security of the system to a single password, making it easier for unauthorized individuals to gain administrative access to the server.
Technical details
An authentication bypass vulnerability exists in Webmin's handling of RPC and Basic authentication. For accounts configured to require a second factor (such as TOTP), the system fails to enforce this requirement when the client authenticates via HTTP Basic authentication. An attacker with knowledge of a valid username and password can bypass the 2FA challenge entirely. The root cause is located in the authentication logic within the miniserv component, specifically affecting how RPC calls validate session requirements. The issue is resolved in version 2.640; a manual patch is available for older versions.
Affected products
- Webmin Webmin < 2.640
Timeline
- 2026-04-15: patched: Fix committed to repository
- 2026-05-16: advisory: GitHub security advisory published
- 2026-07-20: disclosed: CVE published to NVD