CVE-2026-73696
Received Received - Intake

Execution After Redirect in Control Web Panel

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulnCheck

Description
Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call after a header('Location: ...') redirect. Attackers can send unauthenticated requests to continue PHP execution past the redirect, reaching user panel functionality that should require authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-73696

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Control Web Panel Control Web Panel 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-698 The web application sends a redirect to another location, but instead of exiting, it executes additional code.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Control Web Panel (CWP) before version 1.12 has an authentication bypass flaw in its user panel. The vulnerability occurs in the login flow where unauthenticated users can manipulate the system to execute code without proper authentication. Attackers only need a valid hosting username to bypass authentication and access restricted module paths, potentially leading to full system compromise.

Detection Guidance

Detecting this vulnerability requires checking for unauthenticated access to Control Web Panel's user panel. Inspect HTTP responses for redirects without proper termination in CWPUserIndex's unauthenticatedFlow(). Use tools like curl to test if a valid hosting username grants access to restricted paths without authentication. Example: curl -v http://<target>/user/index?module=admin might reveal improper redirects.

Impact Analysis

This vulnerability allows attackers to gain unauthorized access to your CWP server with minimal requirements. They could execute arbitrary code, escalate privileges to root access, and take full control of the system. This could lead to data theft, server hijacking, or deployment of malware.

Compliance Impact

This vulnerability could severely impact compliance by allowing unauthorized access to sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguards for health information. A breach could result in regulatory fines, legal liabilities, and loss of trust due to compromised data integrity and confidentiality.

Mitigation Strategies

Immediately update Control Web Panel to version 1.12 or later to patch the execution after redirect flaw. If an update is unavailable, disable unauthenticated access to user-panel module paths and review authentication flows in CWPUserIndex. Restrict access to sensitive modules until the issue is resolved.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73696. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...