# CVE-2026-42210: Webmin 2FA bypass via Basic authentication

Source: https://junglewise.ai/threats/cve-2026-42210-webmin-2fa-bypass-via-basic-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-42210 · Severity: info · CVSS 5.3 · Published 2026-07-20

Webmin is a web-based interface used to manage Unix-like servers. A security flaw allows an attacker who already knows a user's password to bypass two-factor authentication (2FA) by using a specific type of login method (Basic authentication). This effectively reduces the security of the system to a single password, making it easier for unauthorized individuals to gain administrative access to the server.

Technologies: [Webmin](https://junglewise.ai/threats/technologies/webmin). Vendors: [Webmin](https://junglewise.ai/threats/vendors/webmin).

## Quick answers

**Is CVE-2026-42210 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42210 being exploited in the wild.

**How severe is CVE-2026-42210?** Informational severity, with a CVSS score of 5.3, published 20 July 2026.

**Which products and versions are affected?** Webmin < 2.640.

**Is there a fix for CVE-2026-42210?** A patch was published on 2026-04-15: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42210 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42210?** Check whether you run Webmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass vulnerability exists in Webmin's handling of RPC and Basic authentication. For accounts configured to require a second factor (such as TOTP), the system fails to enforce this requirement when the client authenticates via HTTP Basic authentication. An attacker with knowledge of a valid username and password can bypass the 2FA challenge entirely. The root cause is located in the authentication logic within the miniserv component, specifically affecting how RPC calls validate session requirements. The issue is resolved in version 2.640; a manual patch is available for older versions.

## Affected products

- Webmin Webmin < 2.640

## Timeline

- 2026-04-15: patched: Fix committed to repository
- 2026-05-16: advisory: GitHub security advisory published
- 2026-07-20: disclosed: CVE published to NVD

## References

- [https://github.com/webmin/webmin/commit/da18a16c84ae5c0b78cad79609cb0efb174000ec](https://github.com/webmin/webmin/commit/da18a16c84ae5c0b78cad79609cb0efb174000ec)
- [https://github.com/webmin/webmin/security/advisories/GHSA-qpww-fff2-6fgv](https://github.com/webmin/webmin/security/advisories/GHSA-qpww-fff2-6fgv)

## Related threats

- [Webmin users file injection in cert_issue.cgi](https://junglewise.ai/threats/cve-2026-126781-webmin-through-2-670-contains-a-users-file-injection)
- [Webmin privilege escalation in ACL group module assignment](https://junglewise.ai/threats/cve-2026-126780-webmin-through-2-670-contains-a-privilege-escalation)
- [Webmin stored cross-site scripting in bind8 DNS records](https://junglewise.ai/threats/cve-2026-125392-webmin-through-2-670-contains-a-stored-cross-site-scripting)
- [Webmin OS command injection in samba/save_euser.cgi](https://junglewise.ai/threats/cve-2026-125391-webmin-through-2-670-contains-an-os-command-injection)
- [Webmin stored cross-site scripting in Shorewall modules](https://junglewise.ai/threats/cve-2026-124552-webmin-through-2-670-contains-a-stored-cross-site-scripting)