What is CVE-2026-73696 in Control Web Panel?

Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call after a header('Location:...') redirect as detailed in Rust zip library vulnerability and similar critical security advisories.

Attackers can send unauthenticated requests to continue PHP execution past the redirect, reaching user panel functionality that should require authentication. This architectural oversight mirrors other critical supply-chain and cloud-access flaws like Kaniko credential leak flaw affecting cloud platforms.

The issue has been assigned CVE-2026-73696 and carries a critical CVSS base score of 9.1, indicating a severe risk for server environments relying on this administrative tool for user management and web hosting operations.

Who is affected by this execution after redirect vulnerability?

The vulnerability affects any deployment running Control Web Panel prior to webpanel_version 1.12 where administrative and user panel routines are exposed to the public internet.

Unauthenticated threat actors can leverage this flaw remotely without requiring prior interaction or valid user credentials, posing significant risks to multi-tenant server environments and infrastructure managed by affected instances.

How do I secure my installation?

Administrators must apply the latest software updates provided by the vendor to eliminate the execution path available after HTTP header redirects.

You can review additional guidance and track related ecosystem risks such as SUSE Rancher proxy credentials leak while performing emergency maintenance.

  1. Access your server administrative interface and verify the current running version of Control Web Panel.
  2. Navigate to the official control-webpanel.com changelog at https://control-webpanel.com/changelog to verify patch availability.
  3. Update Control Web Panel to webpanel_version 1.12 or any later secure release.
  4. Verify that unauthenticated requests to the user panel are properly blocked and redirected.