Description (CNA)
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| usmannasir / cyberpanel | affected 0 before 3.0.5; unaffected 3.0.5 |
CWE
CWE-287
References
- https://github.com/usmannasir/cyberpanel/security/advisories/GHSA-h2f7-38ww-5pwc
- https://www.vulncheck.com/advisories/cyberpanel-before-3.0.5-authentication-bypass-via-api
ADP enrichment
No English description supplied.
No references supplied.