vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-42210

Webmin 2FA requirement bypass

MEDIUM
5.3
CVSS Score
Published: July 20, 2026 at 05:03 PM UTC
Updated: July 23, 2026 at 09:12 PM UTC
1 product affected across 1 vendorWebmin

Using webmin by webmin?

Get instant alerts when new vulnerabilities affect webmin - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM5.3
Exploit prediction
EPSS 0.5%
SSVC
No known exploit

Description

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor (typically TOTP), an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication. Webmin is a web-based system administration tool for Unix-like servers. As a workaround, apply the patch from commit da18a16c84ae5c0b78cad79609cb0efb174000ec manually.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Webmin· Webmin
60%
v < 2.640
Affected range stops below 2.640, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (2)

x_refsource_CONFIRM
Source: cverecord
https://github.com/webmin/webmin/security/advisories/GHSA-qpww-fff2-6fgv
x_refsource_MISC
Source: cverecord
https://github.com/webmin/webmin/commit/da18a16c84ae5c0b78cad79609cb0efb174000ec

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.3MEDIUMGitHub_M
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-287

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card