CVE-2026-73696

Name of the Vulnerable Software and Affected Versions Control Web Panel versions prior to 1.12

Description An execution after redirect issue exists in the user panel authentication flow (CWPUserIndex). This occurs because of a missing exit() call following a header('Location: ...') redirect, which allows unauthenticated attackers to bypass authentication. By sending unauthenticated requests, attackers can force the PHP engine to continue execution past the redirect and access user panel functionality that should be restricted.

Recommendations Update to version 1.12 or later.