{"id":"CVE-2026-73696","published":"2026-11-02T15:17:37.480","lastModified":"2026-11-02T19:35:33.347","description":"Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call after a header('Location: ...') redirect. Attackers can send unauthenticated requests to continue PHP execution past the redirect, reaching user panel functionality that should require authentication.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-698"],"vendors":[],"products":[],"references":[{"url":"https://control-webpanel.com/changelog","tags":[]},{"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-execution-after-redirect-in-cwpuserindex","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Control Web Panel (CWP) before version 1.12 has an execution-after-redirect flaw in its user panel authentication flow where unauthenticated attackers can bypass authentication by continuing PHP execution after a Location redirect due to a missing exit() call, gaining unauthorized access to protected functionality.","exploitability":"Trivial to exploit over the network with no authentication or user interaction required; only requires sending an HTTP request to the vulnerable endpoint.","blast_radius":"Successful exploitation grants unauthenticated attackers full access to authenticated user panel features, enabling data exfiltration and account manipulation without detection in many cases.","remediation":"Upgrade to CWP webpanel_version 1.12 or later, which includes the missing exit() call after redirects in the authentication flow.","detection":"Look for HTTP requests to /cwpuser/ or similar user panel endpoints that receive a 3xx redirect response but are followed by a 200 OK response containing user-panel-level content (e.g., dashboard HTML, account data) instead of a login page or error.","tags":["auth-bypass","web","php","cwp","redirect-flaw"],"model":"garnet-coder","analyzedAt":"2026-11-03T09:56:30.287Z"}}