Executive brief
Webmin is a web-based interface for system administration on Unix-like systems. A security flaw allows attackers to bypass multi-factor authentication (MFA) requirements by using a specific browser header. While the attacker still needs a valid username and password, this vulnerability removes a critical layer of security intended to protect administrative accounts from unauthorized access.
Technical details
A multi-factor authentication (MFA) bypass vulnerability exists in Webmin versions prior to 2.641. The application incorrectly allows authentication via HTTP Basic Authentication without requiring session cookies or MFA tokens when the 'User-Agent' header is set to 'webmin'. An attacker with valid user credentials can exploit this to bypass secondary authentication layers. The vulnerability is rooted in the authentication logic that treats requests with this specific User-Agent as exempt from standard session-based MFA checks. Users should upgrade to Webmin 2.641 or later to resolve this issue.
Affected products
- Webmin Webmin prior to 2.641
Timeline
- 2026-05-11: patched: Webmin version 2.641 released
- 2026-06-18: disclosed: CVE published to NVD