Quick answers
- Is CVE-2026-56022 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-56022 being exploited in the wild.
- How severe is CVE-2026-56022?
- Medium severity, with a CVSS score of 5.3, published 18 June 2026.
- Which products and versions are affected?
- Webmin prior to 2.641.
- Is there a fix for CVE-2026-56022?
- A patch was published on 2026-05-11: Webmin version 2.641 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-56022 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-56022?
- Check whether you run Webmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A multi-factor authentication (MFA) bypass vulnerability exists in Webmin versions prior to 2.641. The application incorrectly allows authentication via HTTP Basic Authentication without requiring session cookies or MFA tokens when the 'User-Agent' header is set to 'webmin'. An attacker with valid user credentials can exploit this to bypass secondary authentication layers. The vulnerability is rooted in the authentication logic that treats requests with this specific User-Agent as exempt from standard session-based MFA checks. Users should upgrade to Webmin 2.641 or later to resolve this issue.
Affected products
- Webmin Webmin prior to 2.641
Timeline
- 2026-05-11: patched: Webmin version 2.641 released
- 2026-06-18: disclosed: CVE published to NVD