CVE-2026-73696

Control Web Panel (CWP) versions prior to webpanel_version 1.12 are vulnerable to an execution after redirect (EAR) vulnerability within the CWPUserIndex authentication flow. The root cause is a missing exit() call following a header('Location: ...') redirect, which allows unauthenticated attacke...

CVE-2026-73696 Control Web Panel (CWP) < 1.12 Execution After Redirect in CWPUserIndex

Control Web Panel CWP before webpanelversion 1.12 contains an execution after redirect vulnerability in the user panel authentication flow CWPUserIndex that allows unauthenticated attackers to bypass authentication by exploiting a missing exit call after a header'Location: ...' redirect. Attacker...