External risk intelligence

Control Web Panel Authentication Bypass via Execution After Redirect

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-73696

Control Web Panel (CWP) is a hosting control panel designed to be deployed as an internet-facing administrative and user management interface. By its nature, it acts as a web-based service intended for remote access by administrators and users, making its management and user panels inherently exposed to the internet in common deployment patterns.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in Control Web Panel's user authentication, allowing unauthenticated access to sensitive modules. This issue could enable unauthorized users to gain root access to systems running the affected software. The primary concern is confirming if your environment uses this technology and is exposed.

Authentication bypass allows unauthorized access.
Root access is possible through this vulnerability.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by leveraging a valid hosting username to bypass authentication. This bypass allows them to reach user-panel module code paths. The vulnerability, an execution after redirect flaw, can then lead to unauthorized PHP execution and module dispatcher inclusion without proper checks, potentially enabling a chain to root access.

Requires valid hosting username.
Triggered by an unauthenticated redirect.
Risk of pre-authentication root access.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow an attacker with a valid hosting username to bypass authentication. This could enable them to reach user-panel module code paths and potentially achieve root access on the affected system.

System access and data integrity.
Bypass authentication to reach module code.
Potential for unauthorized root access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Control Web Panel's user panel authentication, allowing attackers with valid hosting usernames to bypass authentication and potentially gain root access. System owners should first identify all instances of Control Web Panel, confirm their external reachability and business criticality, and then ascertain the accountable owner for each instance to plan remediation.

Hosting and infrastructure teams own resolution.
Verify CWP instances and their exposure.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Control Web Panel?

Control Web Panel (CWP) is a web-based hosting control panel used by administrators and users to manage server resources, websites, and email accounts. Because it provides a centralized dashboard for server administration, it is typically deployed as an internet-facing interface to allow remote management from anywhere.

What does 'execution after redirect' mean in CVE-2026-73696?

This flaw, classified as CWE-698, happens when a web application sends a command to redirect a user away from a page but fails to stop processing the current script. In this specific CVE, the software sends the redirect header but continues executing PHP code in the background, allowing unauthorized actions to occur before the browser actually leaves the page.

How is this vulnerability triggered?

An attacker triggers this by interacting with the user panel's authentication flow. They do not need administrative credentials, but they do require a valid hosting username. The vulnerability does not trigger if the user cannot reach the specific login flow or if the system is configured to restrict access to these underlying module paths entirely.

Is my system at risk?

According to Halo Surface Signal, this software is designed to be internet-facing for remote management, which significantly increases its visibility. If your instance is reachable from the public internet, it falls into the highest risk category for this issue. You should prioritize verifying if your deployment is exposed externally.

What should I do first to address CVE-2026-73696?

Your immediate step is to conduct an inventory to locate all running instances of Control Web Panel within your infrastructure. Once identified, evaluate their network exposure and determine the business criticality of each system. Coordinating with your infrastructure or hosting team is essential to ensure that remediation is planned and implemented for all vulnerable instances.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.