CVE-2026-88895: Usmannasir CyberPanel

High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days.

CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.

Affected products

• Usmannasir CyberPanel: before 3.0.5 (fixed in 3.0.5)

Published 2026-09-10. Last modified 2026-09-11.