Control Web Panel (< 1.30) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/control-web-panel--1.30/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 02 Nov 2026 15:47:47 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgControl Web Panel: Authentication bypass via execution after redirect (CVE-2026-73696)https://feed.craftedsignal.io/briefs/2026-11-cwp-auth-bypass/Mon, 02 Nov 2026 15:47:47 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cwp-auth-bypass/Control Web Panel versions prior to 1.12 contain an execution after redirect vulnerability in the user panel authentication flow that allows attackers with a valid username to bypass authentication and achieve unauthorized code execution.Control Web Panel (CWP) versions before 1.12 are vulnerable to an execution after redirect flaw within the user panel authentication process. The unauthenticatedFlow() function in CWPUserIndex initiates a redirect to the login page via toLoginWithIntendedUri() but fails to call exit(), which allows the PHP script execution to proceed. This flaw permits an attacker with a valid hosting username to reach module code paths that should be restricted, potentially leading to unauthorized access and privilege escalation.

Impact

Successful exploitation allows unauthenticated users with a valid hosting account to bypass security controls and interact with internal user-panel modules, which can facilitate a chain of exploitation leading to root-level compromise of the server.

Recommendation

Update all Control Web Panel instances to version 1.12 or later immediately to address the vulnerable authentication logic.

]]>criticaladvisoryweb-vulnerabilityrcecommand-injection