Control Web Panel: Authentication bypass via execution after redirect (CVE-2026-73696)
Control Web Panel versions prior to 1.12 contain an execution after redirect vulnerability in the user panel authentication flow that allows attackers with a valid username to bypass authentication and achieve unauthorized code execution.
CVE search metadata
CVE search record: CVE-2026-73696. Severity: critical. CVSS: 9.8. KEV: no. Product: Control Web Panel (< 1.12). Brief: Control Web Panel: Authentication bypass via execution after redirect (CVE-2026-73696). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cwp-auth-bypass/
Triage facts
Revision 1- Applicability
- Control Web Panel (< 1.12)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 1 public source
- Freshness
- Revision 1Nov 2, 15:47 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Control Web Panel (CWP) versions before 1.12 are vulnerable to an execution after redirect flaw within the user panel authentication process. The unauthenticatedFlow() function in CWPUserIndex initiates a redirect to the login page via toLoginWithIntendedUri() but fails to call exit(), which allows the PHP script execution to proceed. This flaw permits an attacker with a valid hosting username to reach module code paths that should be restricted, potentially leading to unauthorized access and privilege escalation.
Impact
Successful exploitation allows unauthenticated users with a valid hosting account to bypass security controls and interact with internal user-panel modules, which can facilitate a chain of exploitation leading to root-level compromise of the server.
Recommendation
Update all Control Web Panel instances to version 1.12 or later immediately to address the vulnerable authentication logic.
Immediate actions
Patch Control Web Panel to version 1.12 or higher
Threat Hunt
Identify access attempts to user-panel modules from accounts that lack successful authentication headers or sessions
Data: Web server access logs
Mitigations
Upgrade to CWP version 1.12
CVE-2026-73696