CVE-2026-56020: Webmin

High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days.

The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP header. A remote attacker can spoof certificate DNs and authenticate as any user. Fixed in 2.202.

Affected products

• Webmin Webmin: before 2.202 (fixed in 2.202)

Published 2026-06-18. Last modified 2026-08-11.