A critical hard-coded credential vulnerability in CyberPanel allows unauthenticated remote attackers to gain full root access to the system via the WebTerminal service.

The WebTerminal FastAPI service utilizes a hard-coded JSON Web Token (JWT) secret. Unauthenticated attackers can leverage this secret to sign forged tokens, impersonate the root user, and access the terminal service on port 8888.

The ability for an unauthenticated user to obtain an interactive root shell constitutes a total compromise of the server. With a CVSS score of 9.8, this flaw allows for complete data theft, malware installation, and long-term persistence, representing an extreme risk to any organization running affected versions of CyberPanel.

Immediate Action: Upgrade CyberPanel to version 3.0.0 or later to remove the hard-coded secret and secure the JWT implementation.

Proactive Monitoring: Monitor for unusual WebSocket connections on port 8888 and audit access logs for unauthorized root terminal sessions.

Compensating Controls: Disable the WebTerminal service or restrict access to port 8888 via firewall rules to only allow connections from known, trusted IP addresses until an update can be applied.

Public Exploit Available: No

This is an extremely severe vulnerability that enables full system compromise without authentication. Users should upgrade to CyberPanel 3.0.0 or later immediately. If an immediate update is not feasible, the WebTerminal service must be isolated or disabled to prevent remote exploitation.