Cross-Site Request Forgery Vulnerability in 1Panel by 1Panel-dev

CVE-2025-34429

What is CVE-2025-34429?

The web port configuration of 1Panel versions 1.10.33 to 2.0.15 contains a security vulnerability that allows for Cross-Site Request Forgery (CSRF). The absence of CSRF defenses such as anti-CSRF tokens or proper validation checks can enable an attacker to craft a malicious webpage. When an authenticated user visits this page, their browser may unknowingly send a port change request, leveraging valid session cookies. This manipulation can alter the port on which the 1Panel web service operates, potentially disrupting service and removing access to the original port, which may expose the service on an unauthorized port.

References