Authentication Bypass in ArchitectPanel Web Admin Panel

FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel contains an Execution After Redirect (EAR) vulnerability identified as CVE-2026-16323. This vulnerability, documented by the Computer Emergency Response Team of the Republic of Turkey, impacts all versions of the ArchitectPanel Web Admin Panel up to and including the release dated 2026-07-28. The flaw allows an unauthenticated remote attacker to bypass the application's authentication logic due to improper handling of server-side redirects, potentially granting unauthorized access to administrative functions. Defenders should prioritize patching or restricting network access to the web administration interface to mitigate the risk of exploitation.

Impact

Successful exploitation of CVE-2026-16323 allows an attacker to bypass authentication controls, leading to potential full administrative control over the ArchitectPanel instance. This poses a significant risk to organizations using the panel for managing web services, as it could facilitate unauthorized data access, configuration changes, or further compromise of the underlying server infrastructure.

Recommendation

• Immediately restrict access to the ArchitectPanel web administrative interface to trusted management networks only, preventing exposure to the public internet.
• Review web server logs for unauthorized access attempts directed at the administrative URI structures of ArchitectPanel.
• Apply the latest vendor security patches or updates provided by FuyaWeb Internet and Informatics Services to address CVE-2026-16323.