Webmin 2.641 Fixes Three Vulnerabilities Including a Critical Auth Bypass

Webmin released version 2.641 to patch three vulnerabilities—most critically a HTTP header authentication bypass (CVSSv4 9.2) that allows unauthenticated impersonation of any configured user, plus an MFA bypass and a regex-based configuration disclosure; patches are available, no confirmed exploitation yet, and admins should update immediately and restrict access.