CyberPanel JWT Secret Vulnerability: Critical Risk Alert
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- cyberpanel (npm)
- Patched version
- 3.0.0
CyberPanel versions prior to 3.0.0 reportedly contain a critical hard-coded JWT secret vulnerability that could allow unauthenticated remote attackers to gain root access.
What happened
CyberPanel before version 3.0.0 is under investigation for a critical vulnerability in its WebTerminal FastAPI SSH service. This vulnerability involves a hard-coded JWT secret that could be exploited by unauthenticated remote attackers to forge valid authentication tokens. Attackers could use this to obtain an interactive root shell via WebSocket on port 8888. The vulnerability allows attackers to craft a forged JWT signed with the hardcoded secret value, specifying ssh_user=root, to authenticate to the terminal service without any valid credentials and receive a root shell.
The vulnerability has been assigned CVE-2026-67614 with a CVSS score of 9.8, indicating a critical severity level. It is recommended to upgrade to version 3.0.0 or later to mitigate the risk of unauthorized access. There are no reports of this vulnerability being exploited in the wild at this time.
What to do about it
- Upgrade CyberPanel to version 3.0.0 or later to address the hard-coded JWT secret vulnerability.
- Ensure that all instances of CyberPanel in your environment are updated to the patched version.
- Monitor network traffic for any unusual activity on port 8888 which could indicate an attempted exploit.
- Review access logs for any unauthorized access attempts and investigate any suspicious activity.
- Consider implementing additional security measures such as firewall rules to restrict access to the WebTerminal service.
How 0Day would have caught this
cyberpanel is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using CyberPanel version before 3.0.0, you are potentially affected by this vulnerability.
What should I do right now?
Immediately upgrade your CyberPanel installation to version 3.0.0 or later to mitigate the risk.
Is there an official fix available?
Yes, upgrading to CyberPanel version 3.0.0 or later is the recommended action to fix this vulnerability.
Should I be monitoring for any signs of exploitation?
Yes, monitor your network and access logs for any signs of unauthorized access or unusual activity.