Host Header Injection Vulnerability in Control Web Panel by CWP

CVE-2026-124020

What is CVE-2026-124020?

Control Web Panel (CWP) prior to version 1.30.6 is susceptible to a host header injection vulnerability. This flaw permits unauthenticated attackers to tamper with the password recovery process by injecting a malicious HTTP Host header. An attacker can manipulate the /v1/lostpass/ URL, leading automated mail-security scanners to interact with a compromised reset link, thereby exfiltrating the recovery token. By exploiting this vulnerability, attackers can then use the stolen token to gain unauthorized access, reset passwords, and exploit vulnerabilities in the File Manager and Crontab modules, potentially resulting in command execution within the targeted hosting account.

References