CVE-2026-42210: Webmin 2FA Auth Bypass Vulnerability

CVE-2026-42210 Overview

CVE-2026-42210 is an authentication bypass vulnerability in Webmin, a web-based system administration tool for Unix-like servers. The flaw allows attackers who know a valid username and password to bypass the second authentication factor by submitting HTTP Basic authentication instead of the standard session-based login flow. Accounts configured with Time-based One-Time Password (TOTP) or another second factor are affected. The vulnerability is tracked as [CWE-287: Improper Authentication] and is fixed in Webmin 2.640.

Critical Impact
An attacker with knowledge of an account's username and password can log in to Webmin without providing the required second factor, defeating the mitigating control intended to protect against credential compromise.

Affected Products

Webmin versions prior to 2.640
Webmin accounts configured with a second authentication factor (typically TOTP)
Webmin RPC endpoints accepting HTTP Basic authentication

Discovery Timeline

2026-07-20 - CVE-2026-42210 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-42210

Vulnerability Analysis

Webmin supports multiple authentication paths, including session-based login and HTTP Basic authentication used for Remote Procedure Call (RPC) connections between Webmin servers. The session login path enforces the second authentication factor when an account requires one. The Basic authentication path did not consistently apply the same requirement.

An attacker who already possesses valid credentials (for example, through phishing, credential stuffing, or reuse) can send a request with an Authorization: Basic header. Webmin validates the primary credentials and grants access without prompting for the TOTP code. This defeats the defense-in-depth benefit that multi-factor authentication provides against credential theft.

The vulnerability is classified under [CWE-287] Improper Authentication. It requires network access to the Webmin interface and low privileges (a valid username and password), and it results in limited integrity impact by allowing the attacker to operate as the compromised account.

Root Cause

The root cause is inconsistent enforcement of the second-factor requirement across authentication code paths in miniserv.pl and servers/link.cgi. Session-based logins routed through the interactive flow required 2FA, while requests authenticated via HTTP Basic (used for XML-RPC and inter-server communication) skipped the 2FA check.

Attack Vector

Exploitation requires an attacker to already know a valid Webmin username and password. The attacker sends an HTTP request to the Webmin service with a Basic authentication header. Webmin accepts the credentials and issues a session without asking for the TOTP token, granting access equivalent to the compromised account.

text

# Security patch in miniserv.pl - require 2FA for RPC basic auth
 print DEBUG "handle_request: Need authentication\n";
 $validated = 0;
 $blocked = 0;
+local $http_auth_error;
+local $http_auth_reason;
 
 # Session authentication is never used for connections by
 # another webmin server, or for specified pages, or for DAV, or XMLRPC,

Source: Webmin commit da18a16c

The patch introduces localized variables to carry HTTP authentication error state and reason through the request handler, enabling the code to reject Basic-authenticated requests when the account requires a second factor.

text

# Security patch in servers/link.cgi - hardened header parsing on RPC path
-my (%header, $headers);
-while(1) {
-	my $headline;
-	($headline = &read_http_connection($con)) =~ s/\r|\n//g;
-	last if (!$headline);
-	$headline =~ /^(\S+):\s+(.*)$/ || &error("Bad header");
-	$header{lc($1)} = $2;
-	$headers .= $headline."\n";
+my ($header, $headers, $bad) = &read_http_headers($con);
+if ($bad) {
+	$bad =~ s/[\\x00-\\x1f\\x7f]+/ /g;
+	$bad =~ s/\s+/ /g;
+	$bad =~ s/^\s+|\s+$//g;
+	$bad = substr($bad, 0, 200).(length($bad) > 200 ? "..." : "");
+	&error("Bad header : ".&html_escape($bad));
 	}

Source: Webmin commit da18a16c

Detection Methods for CVE-2026-42210

Indicators of Compromise

Successful Webmin logins from accounts with 2FA enabled that lack a corresponding TOTP verification event in the audit trail.
HTTP requests to Webmin endpoints containing Authorization: Basic headers originating from unexpected source IP addresses.
Session creation events for 2FA-required accounts on Webmin versions earlier than 2.640.

Detection Strategies

Review miniserv.log and Webmin authentication logs for Basic authentication requests targeting accounts that should require TOTP.
Correlate successful authentication events with the presence or absence of 2FA challenge records for the same session.
Flag XML-RPC and inter-server RPC traffic to Webmin from hosts that are not authorized Webmin peers.

Monitoring Recommendations

Forward miniserv.log and system authentication logs to a centralized logging platform for analysis and alerting.
Alert on any successful Webmin login for a 2FA-enabled account that did not include a TOTP verification step.
Monitor for unusual source IPs, user agents, or geolocations issuing Basic-authenticated requests to the Webmin management port.

How to Mitigate CVE-2026-42210

Immediate Actions Required

Upgrade Webmin to version 2.640 or later on all managed hosts.
Rotate credentials for any Webmin account that requires 2FA, particularly administrative accounts.
Restrict network access to the Webmin management port (default 10000) to trusted management networks only.
Audit recent authentication events for logins that bypassed the TOTP challenge.

Patch Information

The fix is available in Webmin 2.640. Users who cannot upgrade immediately can manually apply the patch from commit da18a16c84ae5c0b78cad79609cb0efb174000ec. Full technical details are available in the Webmin GitHub Security Advisory GHSA-qpww-fff2-6fgv and the upstream commit.

Workarounds

Manually apply the upstream patch from commit da18a16c84ae5c0b78cad79609cb0efb174000ec to miniserv.pl and servers/link.cgi.
Disable RPC and XML-RPC functionality where inter-server Webmin communication is not required.
Place the Webmin interface behind a reverse proxy or VPN that enforces additional authentication before requests reach Webmin.

bash

# Verify Webmin version and upgrade on Debian/Ubuntu
webmin --version
apt-get update && apt-get install --only-upgrade webmin

# Restrict Webmin listener to a management network in /etc/webmin/miniserv.conf
# allow=10.0.0.0/24
# Then restart the service
systemctl restart webmin