Execution After Redirect Vulnerability in Control Web Panel by CWP
CVE-2026-73696

9.3CRITICAL

Key Information:

Vendor

Control Web Panel

Status
Control Web Panel
Vendor
CVE Published:
2 November 2026

What is CVE-2026-73696?

Control Web Panel (CWP) versions prior to 1.12 are affected by an execution after redirect vulnerability in their user panel authentication flow. The vulnerability arises from the method unauthenticatedFlow() in CWPUserIndex, which calls toLoginWithIntendedUri() and sends a redirect header without terminating the script, allowing for continued PHP execution. This flaw enables attackers with valid hosting usernames to bypass authentication, accessing sensitive user-panel module code paths, thereby facilitating a pre-authentication pathway to escalation of privileges, potentially leading to root access.

Affected Version(s)

Control Web Panel 0 < 1.12

References

https://control-webpanel.com/changelog
release-notespatch
https://www.vulncheck.com/advisories/control-web-panel-cw...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Valentin Lobstein (Chocapikk)
.