CVE-2020-36948
VestaCP 0.9.8-26 - 'LoginAs' Insufficient Session Validation
- State
- Published
- Severity
- 8.7 High
- Published
- Jan 27, 2026
- Updated
- Mar 5, 2026
- Reserved
- Jan 25, 2026
Description
VestaCP 0.9.8-26 contains a session token vulnerability in the LoginAs module that allows remote attackers to manipulate authentication tokens. Attackers can exploit insufficient token validation to access user accounts and perform unauthorized login requests without proper administrative permissions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
VestaCPVestaCP |
|
References
- ExploitDB-49219exploit
- VestaCP Official Homepageproduct
- Vulnerability Lab Advisorytechnical-descriptionexploit
- Benjamin Kunz Mejri Profilevendor-advisory
- VulnCheck Advisory: VestaCP 0.9.8-26 - 'LoginAs' Insufficient Session Validationthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.