CVE-2026-56020
8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP header. A remote attacker can spoof certificate DNs and authenticate as any user. Fixed in 2.641.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Webmin | Webmin | 0 < 2.641 | affected |
| Webmin | Webmin | 2.641 | unaffected |
Weaknesses
- CWE-290: CWE-290 Authentication Bypass by Spoofing
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
- https://github.com/webmin/webmin/releases/tag/2.641
- https://webmin.com/security/#webmin-prior-to-2641
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-02.json
- https://www.cve.org/CVERecord?id=CVE-2026-56020
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.