Cross-Site Request Forgery Vulnerability in 1Panel by 1Panel Dev

CVE-2025-34430

What is CVE-2025-34430?

1Panel versions from 1.10.33 to 2.0.15 have a significant vulnerability in their panel name management feature, which is susceptible to cross-site request forgery (CSRF). The affected functionality lacks essential CSRF protections, such as anti-CSRF tokens or adequate Origin/Referer header checks. This deficiency allows attackers to craft malicious web pages that can manipulate the panel name without the user's consent, provided that the victim is authenticated and unwittingly visits the malicious site. This poses serious risks, enabling unauthorized changes to user configurations under certain conditions.

References