VULNERABILITY INTELLIGENCE
CVE-2020-36948
CVSS score8.7 HIGH
EPSS probability0.63%
CISA KEVNot currently listed
Published2026-01-27
Last modified2026-06-17
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
VestaCP 0.9.8-26 contains a session token vulnerability in the LoginAs module that allows remote attackers to manipulate authentication tokens. Attackers can exploit insufficient token validation to access user accounts and perform unauthorized login requests without proper administrative permissions.
Weakness classification
- CWE-863: Incorrect Authorization