H3-2026-1119¶
CyberPanel phpMyAdmin Signon Authentication Bypass Vulnerability
| Category | VULNERABILITY |
| Base Score | 9.8 |
Description¶
CyberPanel's phpmyadminsignin.php endpoint accepts any posted username and password pair and only requires that a PHP session on the phpMyAdmin virtual host carry a userID value. That PHP session is derived from the Django session through the project's LSCPD integration, but the signon endpoint performs no further authorization check against the requested MySQL account. Remote attackers who hold any valid CyberPanel session can post arbitrary MySQL credentials, including the root account, and be logged into phpMyAdmin as that account. Combined with known default CyberPanel credentials, this allows attackers to reach phpMyAdmin as MySQL root starting from an unauthenticated state.
Impact¶
Attackers gain phpMyAdmin access as any MySQL user, including root, enabling full database compromise. Reading stored credentials, modifying data, and potential remote code execution through MySQL file write features follow. CyberPanel hosting deployments with unrotated default credentials are at highest risk.