| Package | Affected versions | Patched versions |
|---|---|---|
| webmin | < 2.640 | 2.640 |
Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements. Fixed in 2.640.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free