CVE-2026-73696
High
Description
Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call after a header('Location: ...') redirect. Attackers can send unauthenticated requests to continue PHP execution past the redirect, reaching user panel functionality that should require authentication.
SeverityHigh
CVSS8.1
Exploit probability—
ProductControl Web Panel
PublishedNov 2, 2026
First seenNov 4, 2026
Weakness typeCWE-698CWE-698
How to fix
Update
- Control Web Panel Control Web Panel1.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Control Web Panel Control Web Panel | v < 1.12 | 1.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.