A hard-coded JWT signing secret in CyberPanel's WebTerminal SSH service is reported to let unauthenticated remote attackers forge valid tokens and open an interactive root shell over WebSocket on port 8888.
What Is It
According to the CVE record and the accompanying VulnCheck advisory, CyberPanel versions before 3.0.0 ship a hard-coded JWT secret (CWE-798) in the WebTerminal FastAPI SSH service. Because the signing key is described as a known constant baked into the product, anyone in possession of it can mint a token the service will accept. The advisory describes an attack in which a JWT is signed with that secret with ssh_user=root set, then used to connect to the terminal service over WebSocket on port 8888 with no credentials; yielding an interactive root shell on the host.
These mechanics come from the initial disclosure rather than from a completed independent analysis, so specifics such as the exact token claims and reachable endpoints should be treated as provisional.
Why It Matters
If the reported behavior holds, this is a complete authentication bypass with a direct path to full system compromise. The record carries a CVSS 3.1 base score of 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, alongside a CVSS 4.0 score of 9.3 (Critical) from the same source. Every exploitability factor in the 3.1 vector is worst-case: network attack vector, low complexity, no privileges, no user interaction, and high impact to confidentiality, integrity, and availability. These scores were submitted with the initial record and may change once NVD analysis is complete.
CyberPanel is a hosting control panel, so a compromised instance would typically mean root on a box running customer websites, mail, and databases. As described, the attack requires no chained bugs and no stolen credentials; only reachability of port 8888.
What's Vulnerable
- Vendor/product: usmannasir / cyberpanel (
pkg:github/usmannasir/cyberpanel) - Affected versions: all versions before 3.0.0 (semver, default status affected)
- Affected component: WebTerminal FastAPI SSH service, WebSocket listener on TCP 8888
Patch Status
The affected range in the NVD record terminates below 3.0.0, which points to 3.0.0 as the first unaffected release. That is an inference from the version metadata rather than a confirmed vendor fix advisory, so verify against the CyberPanel change logs before treating an upgrade as remediation. Upgrading to 3.0.0 or later is the indicated action; until that is complete, restrict network access to port 8888 so the WebTerminal service is not reachable from untrusted networks.
CVE-2026-67614 does not appear in the CISA Known Exploited Vulnerabilities catalog, so no federal remediation deadline applies and there is no authoritative confirmation of active exploitation at this time. The CVE was published 2026-08-13 and remains in "Received" status at NVD, meaning analysis is not yet complete and any field in the record may still change.