CVE-2026-56022: 
Webmin vulnerability analysis and mitigation

CVE-2026-56022 is an authentication bypass vulnerability in Webmin that allows unauthenticated network attackers to circumvent multi-factor authentication (MFA) requirements. When an attacker supplies the User-Agent: webmin header, Webmin accepts HTTP Basic Authentication without requiring session cookies, effectively bypassing any additional MFA controls configured on the administrative interface. All Webmin versions prior to 2.641 are affected. The vulnerability was published on June 18, 2026, and carries a CVSS v3.1 score of 5.3 (Medium) and a CVSS v4.0 score of 6.9 (Medium) (Github Advisory, Feedly).

The root cause is classified as CWE-308 (Use of Single-factor Authentication): Webmin's authentication logic contains a code path that, when triggered by the User-Agent: webmin header, accepts HTTP Basic Authentication credentials without enforcing session cookie validation or MFA challenges. This means an attacker who possesses valid credentials (or can brute-force/credential-stuff them) can authenticate directly to the Webmin administrative interface by crafting a simple HTTP request with the specific User-Agent string, bypassing any second-factor requirement entirely. No special privileges or user interaction are required beyond knowledge of valid credentials and the bypass technique (Github Advisory, Feedly).

Successful exploitation allows an attacker to gain unauthorized access to the Webmin administrative interface, which typically runs with root-level privileges on Linux/Unix systems. While the CVSS scoring reflects a low integrity impact in isolation, practical exploitation of Webmin admin access can lead to full server compromise, including arbitrary command execution, configuration changes, user management, and lateral movement across managed systems. Confidentiality of sensitive server data and availability of hosted services are also at risk once administrative access is obtained (Github Advisory, VPNCentral).

As of the time of publication, there is no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.308%, placing it in the 23rd percentile for exploitation likelihood within 30 days (Github Advisory). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported. However, the bypass technique is conceptually simple — requiring only a crafted HTTP header — which lowers the barrier for exploitation if credentials are obtained through other means.

1. Reconnaissance: Identify internet-facing Webmin instances (default port 10000) using tools like Shodan (port:10000 product:Webmin) or Censys, targeting versions prior to 2.641.
2. Credential acquisition: Obtain valid Webmin credentials through brute force, credential stuffing, phishing, or reuse of previously leaked credentials, since the bypass requires a valid username/password pair.
3. Craft malicious request: Construct an HTTP Basic Authentication request to the Webmin login endpoint, including the header User-Agent: webmin to trigger the vulnerable code path that skips session cookie and MFA validation.
4. Bypass MFA: Submit the crafted request (e.g., curl -u admin:password --header 'User-Agent: webmin' https://<target>:10000/) — Webmin processes the Basic Auth credentials without prompting for or validating a second factor.
5. Achieve administrative access: With authenticated access to the Webmin interface, execute arbitrary commands, modify system configuration, create backdoor accounts, or pivot to other systems managed through Webmin (Github Advisory, Feedly).

• Network: HTTP requests to Webmin (typically port 10000) containing the User-Agent: webmin header in authentication attempts; Basic Authentication requests that do not follow the normal session-cookie-based login flow.
• Logs: Webmin access logs showing successful authentications via Basic Auth without corresponding session establishment or MFA challenge/response entries; repeated login attempts from unusual source IPs using the webmin User-Agent string.
• Process: Unexpected administrative actions in Webmin audit logs (user creation, command execution, configuration changes) occurring without a corresponding interactive session; new cron jobs, SSH keys, or system users created shortly after anomalous authentication events.

The primary remediation is to upgrade Webmin to version 2.641 or later, which contains the fix for this vulnerability (Webmin Release, Github Advisory). As interim workarounds, administrators should restrict network access to the Webmin interface (port 10000) using firewall rules, allowing only trusted IP addresses. Additionally, monitoring web server logs for requests containing User-Agent: webmin in authentication contexts can help detect exploitation attempts. Enforcing strong, unique credentials reduces the risk of credential-based attacks that would be combined with this bypass.

Security news outlets including SecurityOnline, CyberPress, CyberSecurityNews, and VPNCentral covered the vulnerability in the context of the Webmin 2.641 release, noting the MFA bypass alongside a separate XSS vulnerability patched in the same version (VPNCentral, CyberSecurityNews). Community discussion on Bluesky and Mastodon/infosec.exchange noted the vulnerability shortly after disclosure. Coverage generally characterized the flaw as significant given Webmin's widespread use for Linux server administration, with emphasis on the simplicity of the bypass technique.