CVE-2026-67614

Name of the Vulnerable Software and Affected Versions CyberPanel versions prior to 3.0.0

Description The WebTerminal FastAPI SSH service contains a hard-coded JSON Web Token (JWT) secret. This allows unauthenticated remote attackers to forge valid authentication tokens by signing them with the hard-coded secret value. By specifying the ssh user variable as root, an attacker can authenticate to the terminal service via WebSocket on port 8888 without valid credentials to obtain an interactive root shell.

Recommendations Update CyberPanel to version 3.0.0 or later.