The Webmin HTTP server, miniserv.pl, contains an authentication bypass that permits attackers without legitimate credentials to forge HTTP headers and impersonate any user whose account is linked to an SSL client certificate. By spoofing the certificate subject name (DN) in the forged header, an unauthenticated attacker can acquire a session token normally reserved for the real certificate holder, thereby gaining the privileges of that user. This weakness is an example of improper authentication enforcement (CWE‑290). The flaw is fixed in version 2.202.

All installations of Webmin prior to release 2.202 are vulnerable. The flaw applies to any version of the Webmin suite that supports SSL client certificate authentication, regardless of the operating system or environment. The affected component is the miniserv.pl HTTP server handling SSL client certificates.

With a CVSS score of 9.2 the vulnerability is considered critical. The EPSS score is currently reported as < 1%, and the vulnerability is not listed in the CISA KEV catalog. An attacker needs only to send a crafted HTTP request over the network to the Webmin server; no local access or privileged credentials are required. The attack path is purely remote, making the potential impact immediate and widespread if the Webmin instance is exposed to the internet or a compromised internal network.