CVE-2026-73696: Control Web Panel (CWP) < 1.12 Execution After Redirect in CWPUserIndex

Q: Who is exposed to this vulnerability?

Instances running Control Web Panel with webpanel_version earlier than 1.12 are affected if an attacker can send requests to the user panel authentication flow (CWPUserIndex). The issue is remotely exploitable without authentication or user interaction.

Q: What does an attacker need to exploit it?

An attacker needs network access to the affected CWP user panel and the ability to submit unauthenticated requests. Exploitation relies on PHP continuing execution after a Location redirect because the authentication flow does not terminate with exit().

Q: Is a default or unauthenticated deployment affected?

Yes. The vulnerability is specifically an authentication-bypass condition and requires no prior privileges, as reflected by PR:N and UI:N. Any affected version with the vulnerable user panel authentication flow reachable may be exposed.

Q: How can I determine whether an installation is affected?

Check the installed CWP webpanel_version. Versions before 1.12 are affected; version 1.12 is the stated fixed threshold.

Published Nov 2, 2026

Updated

Control Web Panel (CWP) before webpanelversion 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call after a header('Location: ...') redirect. Attackers can send unauthenticated requests to continue PHP execution past the redirect, reaching user panel functionality that should require authentication.

Event History

Nov 2, 2026

CVE Published

via MITRE·02:52 PM

Data Sourced

via MITRE·02:52 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this vulnerability?

Instances running Control Web Panel with webpanel_version earlier than 1.12 are affected if an attacker can send requests to the user panel authentication flow (CWPUserIndex). The issue is remotely exploitable without authentication or user interaction.

What does an attacker need to exploit it?

An attacker needs network access to the affected CWP user panel and the ability to submit unauthenticated requests. Exploitation relies on PHP continuing execution after a Location redirect because the authentication flow does not terminate with exit().

Is a default or unauthenticated deployment affected?

Yes. The vulnerability is specifically an authentication-bypass condition and requires no prior privileges, as reflected by PR:N and UI:N. Any affected version with the vulnerable user panel authentication flow reachable may be exposed.

How can I determine whether an installation is affected?

Check the installed CWP webpanel_version. Versions before 1.12 are affected; version 1.12 is the stated fixed threshold.

CVE-2026-73696: Control Web Panel (CWP) < 1.12 Execution After Redirect in CWPUserIndex

Event History

Frequently Asked Questions

Who is exposed to this vulnerability?

What does an attacker need to exploit it?

Is a default or unauthenticated deployment affected?

How can I determine whether an installation is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this vulnerability?

What does an attacker need to exploit it?

Is a default or unauthenticated deployment affected?

How can I determine whether an installation is affected?