Description
CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed with the hardcoded secret value, specifying ssh_user=root, to authenticate to the terminal service without any valid credentials and receive a root shell.
Published: 2026-08-13
Score: 9.3 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A hard‑coded JSON Web Token secret in CyberPanel’s WebTerminal FastAPI SSH service allows an attacker to forge a valid JWT that authenticates as root. The forged token bypasses all credential checks, enabling an interactive root shell over WebSocket, which is a clear Remote Code Execution vulnerability (CWE‑798).

Affected Systems

CyberPanel from usmannasir, versions earlier than 3.0.0 are vulnerable.

Risk and Exploitability

The CVSS score of 9.3 categorises the flaw as Critical. The EPSS score is not available, and this issue is not listed in the CISA KEV catalog. Exploitation requires only network reachability to port 8888; an unauthenticated attacker can craft the JWT and obtain a root shell without prior access or credentials. The potential impact is full system compromise.

Generated by OpenCVE AI on August 13, 2026 at 18:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade CyberPanel to version 3.0.0 or newer to remove the hard‑coded JWT secret.
  • Disable the WebTerminal service or restrict access to port 8888 if an upgrade must be delayed.
  • Monitor server logs for suspicious JWT activity and terminate any unauthorised WebSocket sessions.

Generated by OpenCVE AI on August 13, 2026 at 18:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Usmannasir
Usmannasir cyberpanel
Vendors & Products Usmannasir
Usmannasir cyberpanel

Thu, 13 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Description CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed with the hardcoded secret value, specifying ssh_user=root, to authenticate to the terminal service without any valid credentials and receive a root shell.
Title CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminal
Weaknesses CWE-798
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Usmannasir Cyberpanel
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-13T17:08:40.038Z

Reserved: 2026-07-29T21:07:39.203Z

Link: CVE-2026-67614

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-13T18:18:08.370

Modified: 2026-08-13T18:18:08.370

Link: CVE-2026-67614

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T19:00:12Z

Weaknesses
  • CWE-798

    Use of Hard-coded Credentials