CVE-2026-124020

Received Received - Intake

Control Web Panel Host Header Injection Vulnerability

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description

Control Web Panel (CWP) before webpanel_version 1.30.6 contains a host header injection vulnerability that allows unauthenticated attackers to manipulate the password-recovery reset URL by injecting the HTTP Host header into the /v1/lostpass/ route's token generation process. Attackers can lure an automated mail-security scanner into visiting the poisoned reset link to exfiltrate the live recovery token, replay it at /login/index.php?acc=newpass to set a new password, and subsequently abuse the File Manager and Crontab modules to achieve command execution as the targeted hosting account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-13

Last Modified

2026-11-13

Generated

2026-11-14

AI Q&A

2026-11-14

EPSS Evaluated

N/A

NVD

CVE-2026-124020

Affected Vendors & Products

Vendor	Product	Version / Range
Control Web Panel	Control Web Panel	From 0 (inc) to 1.30.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-640	The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Attack-Flow Graph

Executive Summary

Control Web Panel (CWP) before version 1.30.6 has a host header injection flaw. Attackers can manipulate the password recovery URL by injecting the HTTP Host header into the token generation process. This allows them to trick a mail-security scanner into visiting a malicious reset link, steal the live recovery token, and then reset the victim's password to gain unauthorized access.

Detection Guidance

Detecting this vulnerability requires checking for Control Web Panel (CWP) versions before 1.30.6. Inspect the webpanel_version file or run commands like 'rpm -qa | grep cwp' or 'dpkg -l | grep cwp' to verify the installed version. Monitor HTTP Host header manipulation attempts in web server logs for suspicious reset URL patterns.

Impact Analysis

If you use CWP versions before 1.30.6, attackers could hijack your password recovery process, reset your account password, and gain full control over your hosting account. They could then abuse File Manager and Crontab modules to execute arbitrary commands on your system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face compliance breaches, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately update Control Web Panel to version 1.30.6 or later. Disable password recovery features if not needed. Restrict access to the /v1/lostpass/ route via firewall rules. Monitor for unauthorized password reset attempts and review File Manager and Crontab module access logs.

Hi! I’m here to help you understand CVE-2026-124020. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...