miniserv.pl in Webmin before 1.230 and Usermin before 1.160 when \full PAM conversations\ is enabled allows remote attackers to bypass authentication by spoofing session IDs via certain metacharacters (line feed or carriage return).