EIP-2026-104479

This advisory details an insufficient session validation vulnerability in VestaCP 0.9.8-26, allowing remote attackers to download backup files without proper authentication by omitting the token parameter. The writeup includes technical details, affected modules, and proof-of-concept URLs.