CVE-2026-73696 — Vulnerability intelligence

Control Web Panel — Control Web Panel

Published: 2026-11-02T14:52:29.886Z

CVSS

8.6

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call after a header('Location: ...') redirect. Attackers can send unauthenticated requests to continue PHP execution past the redirect, reaching user panel functionality that should require authentication.

Sources

• CVE-2026-73696
• Original advisory
• Original advisory
• CVE-2026-73696
• Original advisory