Description
Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call after a header('Location: ...') redirect. Attackers can send unauthenticated requests to continue PHP execution past the redirect, reaching user panel functionality that should require authentication.
Published: 2026-11-02
Score: 9.3 Critical
EPSS: n/a
KEV: No
Impact: Authentication Bypass through Execution After Redirect
Action: Patch Immediately
AI Analysis

Impact

Control Web Panel before version 1.12 contains a flaw that allows unauthenticated attackers to execute PHP code after a redirect by missing an exit() call following a header('Location: ...') statement. This flaw is classified under CWE-698 and enables an attacker to bypass authentication and access the user panel functionality with no credentials, leading to unauthorized disclosure, modification, or potential disruption of user data and services.

Affected Systems

All releases of Control Web Panel prior to version 1.12 are affected. No specific sub‑versions are listed, so operators must treat all earlier releases as vulnerable.

Risk and Exploitability

The vulnerability has a CVSS score of 9.3, indicating high severity and potentially remote exploitation through normal HTTP access. No EPSS data is available, and it is not listed in CISA’s KEV catalog, but the lack of authentication checks and the nature of the flaw suggest that exploitation can be achieved by any unauthenticated user who can reach the affected endpoint.

Generated by OpenCVE AI on November 2, 2026 at 17:44 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Control Web Panel to version 1.12 or later to apply the vendor fix.
  • If an upgrade is not immediately feasible, modify the CWPUserIndex file to add an exit() statement immediately after the header('Location: ...') redirect so that PHP execution stops before authentication logic is bypassed.
  • Restrict direct access to the affected endpoint by configuring the web server or application firewall to allow requests only from authenticated sessions or to block unauthenticated requests to the user panel URLs.

Generated by OpenCVE AI on November 2, 2026 at 17:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Nov 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 02 Nov 2026 16:30:00 +0000

Type Values Removed Values Added
References

Mon, 02 Nov 2026 15:30:00 +0000

Type Values Removed Values Added
Description Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow, where CWPUserIndex's unauthenticatedFlow() calls toLoginWithIntendedUri() which emits a redirect header without exit(), allowing PHP execution to continue and the module dispatcher include to run without authentication. Attackers with nothing more than a valid hosting username can bypass authentication to reach user-panel module code paths, enabling a pre-authentication chain to root access. Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call after a header('Location: ...') redirect. Attackers can send unauthenticated requests to continue PHP execution past the redirect, reaching user panel functionality that should require authentication.
Title Control Web Panel (CWP) < 1.12 Authentication Bypass via Execution After Redirect Control Web Panel (CWP) < 1.12 Execution After Redirect in CWPUserIndex
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

 cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Mon, 02 Nov 2026 15:00:00 +0000

Type Values Removed Values Added
Description Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow, where CWPUserIndex's unauthenticatedFlow() calls toLoginWithIntendedUri() which emits a redirect header without exit(), allowing PHP execution to continue and the module dispatcher include to run without authentication. Attackers with nothing more than a valid hosting username can bypass authentication to reach user-panel module code paths, enabling a pre-authentication chain to root access.
Title Control Web Panel (CWP) < 1.12 Authentication Bypass via Execution After Redirect
First Time appeared Control-webpanel
Control-webpanel webpanel
Weaknesses CWE-698
CPEs cpe:2.3:a:control-webpanel:webpanel:*:*:*:*:*:*:*:*
Vendors & Products Control-webpanel
Control-webpanel webpanel
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Control-webpanel Webpanel
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-02T17:30:37.671Z

Reserved: 2026-08-13T15:15:54.513Z

Link: CVE-2026-73696

cve-icon Vulnrichment

Updated: 2026-11-02T17:14:13.045Z

cve-icon NVD

Status : Deferred

Published: 2026-11-02T15:17:37.480

Modified: 2026-11-02T19:35:33.347

Link: CVE-2026-73696

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-02T17:45:12Z

Weaknesses
  • CWE-698

    Execution After Redirect (EAR)