CVE-2026-73696

Summary

Control Web Panel (CWP) before version 1.12 has an execution-after-redirect flaw in its user panel authentication flow where unauthenticated attackers can bypass authentication by continuing PHP execution after a Location redirect due to a missing exit() call, gaining unauthorized access to protected functionality.

Exploitability

Trivial to exploit over the network with no authentication or user interaction required; only requires sending an HTTP request to the vulnerable endpoint.

Blast radius

Successful exploitation grants unauthenticated attackers full access to authenticated user panel features, enabling data exfiltration and account manipulation without detection in many cases.

Detection

Look for HTTP requests to /cwpuser/ or similar user panel endpoints that receive a 3xx redirect response but are followed by a 200 OK response containing user-panel-level content (e.g., dashboard HTML, account data) instead of a login page or error.

Prioritized remediation

Upgrade to CWP webpanel_version 1.12 or later, which includes the missing exit() call after redirects in the authentication flow.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.