CVE-2026-88895 describes an improper authentication vulnerability in CyberPanel prior to version 3.0.5. The product fails to enforce two-factor authentication (2FA) on API endpoints, permitting attackers who have obtained an administrator's password to bypass the Time-based One-Time Password (TOTP) requirement. By deriving API tokens from the password, attackers can perform administrative operations or establish authenticated sessions without needing the second authentication factor.

An attacker with knowledge of an administrator's password can bypass two-factor authentication on API endpoints, potentially gaining full administrative access and control over the CyberPanel instance. This elevates the risk of unauthorized administrative actions and session hijacking without the need for the second authentication factor.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to administrator credentials and monitor for unauthorized API token usage. Applying version 3.0.5 or later, once confirmed, is expected to resolve this issue.