Back to overview

CVE-2020-36948

CRITICAL Exploitation: PoC
9.8
CVSS 3.1
Description
VestaCP 0.9.8-26 contains a session token vulnerability in the LoginAs module that allows remote attackers to manipulate authentication tokens. Attackers can exploit insufficient token validation to access user accounts and perform unauthorized login requests without proper administrative permissions.

Metadata

CVE ID
CVE-2020-36948
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-01-25 13:50 UTC
Published
2026-01-27 15:23 UTC
Last updated
2026-03-05 01:27 UTC
Primary CWE
CWE-863
Incorrect Authorization
Vendor / Product
VestaCP / VestaCP
Sources
cve.org  ·  NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
no
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
VestaCP VestaCP — 0.9.8-26
Weakness (CWE)
CWESourceDescription
CWE-863 cna Incorrect Authorization
CVSS scores (2)
ScoreSeverityVersionSourceVector
9.8 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.7 HIGH 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References (5)
Back to overview