CVE-2020-36948: VestaCP Authentication Bypass Vulnerability

CVE-2020-36948 Overview

CVE-2020-36948 is an authorization vulnerability in VestaCP 0.9.8-26 affecting the LoginAs module. The flaw stems from insufficient session token validation, allowing authenticated remote attackers to manipulate authentication tokens and access user accounts without proper administrative permissions. The weakness is classified under CWE-863: Incorrect Authorization. VestaCP is an open-source hosting control panel used to manage web, mail, DNS, and database services. Successful exploitation enables attackers to impersonate other users on the panel, leading to compromise of hosted services and data.

Critical Impact

Authenticated attackers can hijack arbitrary user sessions through the LoginAs module, gaining unauthorized access to user accounts and their managed services.

Affected Products

• VestaCP 0.9.8-26
• VestaCP LoginAs module
• Hosting environments running the affected VestaCP build

Discovery Timeline

• 2026-01-27 - CVE-2020-36948 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2020-36948

Vulnerability Analysis

The vulnerability resides in the LoginAs functionality of VestaCP 0.9.8-26. This feature is intended to let administrators switch into a target user account for support and management workflows. The implementation fails to enforce sufficient validation on the session token presented during the LoginAs request. As a result, an attacker with a low-privilege authenticated session can manipulate the authentication token used by the LoginAs flow and trigger login requests against arbitrary accounts. Because the panel honors the manipulated token as if it originated from an administrative context, the request succeeds without the actor holding administrative permissions.

Root Cause

The root cause is incorrect authorization [CWE-863] in the LoginAs request handler. The server does not properly verify that the calling principal owns the privileges required to assume another user identity, nor does it cryptographically bind the session token to the requesting user. This logic gap converts a privileged administrative function into an action callable by lower-privileged accounts.

Attack Vector

The attack vector is network-based and requires low privileges with no user interaction. An attacker authenticates to VestaCP with any valid account, then issues a crafted LoginAs request with a manipulated session token to impersonate a target user. Public exploitation details for this issue are documented in Exploit-DB entry 49219, the VulnCheck advisory, and Vulnerability Lab report 2240.

No verified proof-of-concept code is reproduced here. Refer to the linked advisories for request-level technical details.

Detection Methods for CVE-2020-36948

Indicators of Compromise

• Unexpected LoginAs events in VestaCP logs originating from non-administrative accounts.
• Session activity for a user account from an IP address or User-Agent that recently authenticated as a different, lower-privileged user.
• Sudden privilege transitions in the panel audit trail without a corresponding administrator login.

Detection Strategies

• Audit VestaCP web server logs for requests to LoginAs endpoints and correlate the source session with the account ultimately accessed.
• Alert on session token reuse where the same token authenticates requests as multiple distinct users within a short window.
• Baseline normal administrative LoginAs usage and flag deviations such as off-hours impersonation events or non-admin originators.

Monitoring Recommendations

• Forward VestaCP access and audit logs to a centralized SIEM or data lake for correlation against authentication events.
• Monitor outbound activity from hosted accounts immediately following LoginAs events to identify post-impersonation abuse.
• Track failed and successful authentication transitions per source IP to detect enumeration of accounts through the LoginAs flow.

How to Mitigate CVE-2020-36948

Immediate Actions Required

• Upgrade VestaCP beyond version 0.9.8-26 to a release that addresses the LoginAs authorization flaw, or migrate to an actively maintained fork.
• Restrict panel access to trusted management networks using firewall rules or VPN-only access to reduce exposure of authenticated attackers.
• Rotate all VestaCP user credentials and invalidate existing sessions to remove any tokens that may have been manipulated.
• Review panel audit logs for prior LoginAs activity that cannot be tied to an authorized administrator action.

Patch Information

VestaCP 0.9.8-26 is the affected version identified in the advisories. Operators should consult the VestaCP official website and the VulnCheck advisory for the latest available builds and fixed releases. VestaCP development has been historically inconsistent; where no vendor patch is available, migration to a maintained alternative is the recommended long-term remediation.

Workarounds

• Disable or remove the LoginAs functionality in the panel configuration if a vendor fix is unavailable.
• Limit account creation on the panel and remove unused low-privilege accounts to shrink the pool of viable attacker starting points.
• Place the VestaCP administrative interface behind a reverse proxy that enforces additional authentication, such as mutual TLS or an SSO gateway.

# Example: restrict VestaCP admin port (default 8083) to a management subnet
iptables -A INPUT -p tcp --dport 8083 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8083 -j DROP