CVE-2026-73696 Control Web Panel (CWP) < 1.12 Execution After Redirect in CWPUserIndex

Control Web Panel CWP before webpanelversion 1.12 contains an execution after redirect vulnerability in the user panel authentication flow CWPUserIndex that allows unauthenticated attackers to bypass authentication by exploiting a missing exit call after a header'Location: ...' redirect. Attacker...

CVE-2026-73696

Control Web Panel (CWP) versions before webpanel_version 1.12 are vulnerable to an Execution After Redirect (EAR) vulnerability. In the user panel authentication flow, the CWPUserIndex component's unauthenticatedFlow() calls toLoginWithIntendedUri(), which issues a redirect header but fails to ca...