CVE-2026-124020: Control Web Panel < 1.30.6 Host Header Password Reset Poisoning
Control Web Panel (CWP) before webpanelversion 1.30.6 contains a host header injection vulnerability that allows unauthenticated attackers to manipulate the password-recovery reset URL by injecting the HTTP Host header into the /v1/lostpass/ route's token generation process. Attackers can lure an automated mail-security scanner into visiting the poisoned reset link to exfiltrate the live recovery token, replay it at /login/index.php?acc=newpass to set a new password, and subsequently abuse the File Manager and Crontab modules to achieve command execution as the targeted hosting account.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Control Web Panelto a version that resolves this vulnerability.Fixed in 1.30.6
Event History
Frequently Asked Questions
Which deployments are affected?
Control Web Panel installations with webpanel_version earlier than 1.30.6 are affected. The vulnerable password-recovery endpoint is /v1/lostpass/.
What does an attacker need to exploit this?
The attacker does not need authentication or user interaction from the targeted account. Exploitation requires manipulating the HTTP Host header and luring an automated mail-security scanner into requesting the poisoned password-reset link.
What is the practical impact after token theft?
A stolen live recovery token can be replayed at /login/index.php?acc=newpass to set a new password for the targeted hosting account. The attacker can then use the File Manager and Crontab modules to obtain command execution as that account.
How can I determine whether an installation is vulnerable?
Check the Control Web Panel webpanel_version. Versions before 1.30.6 should be treated as affected.