Vulnerability · Published Jan 27, 2026 · Assigned by VulnCheck
CVE-2020-36948VestaCP 0.9.8-26 - 'LoginAs' Insufficient Session Validation
Critical 9.8
In plain English
A critical-severity incorrect authorization in VestaCP from VestaCP. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.6%top 49.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
VestaCP 0.9.8-26 contains a session token vulnerability in the LoginAs module that allows remote attackers to manipulate authentication tokens. Attackers can exploit insufficient token validation to access user accounts and perform unauthorized login requests without proper administrative permissions.
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-49219 exploit
- VestaCP Official Homepage product
- Vulnerability Lab Advisory technical-description, exploit
- Benjamin Kunz Mejri Profile vendor-advisory
- VulnCheck Advisory: VestaCP 0.9.8-26 - 'LoginAs' Insufficient Session Validation third-party-advisory