Vulnerability · Published Nov 2, 2026 · Assigned by VulnCheck

CVE-2026-73696Control Web Panel (CWP) < 1.12 Execution After Redirect in CWPUserIndex

High 8.1

In plain English

A high-severity security flaw in Control Web Panel from Control Web Panel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 57.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call after a header('Location: ...') redirect. Attackers can send unauthenticated requests to continue PHP execution past the redirect, reaching user panel functionality that should require authentication.

Affected products (as reported)

Vendor	Product	Versions
Control Web Panel	Control Web Panel	0 – before 1.12

Weakness: CWE-698 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

Changelog release-notes, patch
VulnCheck Blog technical-description, exploit
VulnCheck Advisory: Control Web Panel (CWP) < 1.12 Authentication Bypass via Execution After Redirect third-party-advisory