---
id: "CVE-2026-116371"
kind: "vulnerability"
aliases: ["CVE-2026-116371"]
title: "Akuvox HyPanel PS51: login flaw allows improper authentication remotely"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["akuvox", "hypanel", "infrastructure", "iot", "ps51", "self-hosted"]
not_affected_if: ["no-network-exposure", "other-versions"]
published_at: "2026-10-26T17:17:26+00:00"
first_seen_at: "2026-10-26T17:31:22+00:00"
updated_at: "2026-10-26T17:33:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116371", "first_seen_at": "2026-10-26T17:31:22+00:00"}]
---

# Akuvox HyPanel PS51: login flaw allows improper authentication remotely

Akuvox Akubela HyPanel PS51 version 51.130.40.26 has a weakness in its /login handler where manipulating the engrmode argument with the value admin leads to improper authentication. The sources say an attacker can trigger it remotely, and the vendor did not respond to early disclosure.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the device or panel runs `51.130.40.26` of HyPanel PS51 (the version is shown in the admin interface; exact location unknown)
- Check whether `/login` on the HyPanel web interface accepts an `engrmode` parameter set to `admin` (unknown from sources)

## Fix

- No vendor fix is documented in the sources; the vendor did not respond to disclosure
- Restrict network access to the HyPanel management interface until a fixed version or vendor guidance is available

## Timeline

- 2026-10-26T17:31:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116371

## From the sources

A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. The impacted element is an unknown function of the file /login. Executing a manipulation of the argument engrmode with the input admin can lead to improper authentication. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_