CVE-2025-66508
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
Dec 9, 2025
CISA due date
—
The record
1Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/1Panel-dev/1Panel | 0 | 2.0.14+incompatible |
| Go | github.com/1Panel-dev/1Panel | 0 | 2.0.14 |
| Go | github.com/1Panel-dev/1Panel/agent | 0 | 0.0.0-20251201063338-94f7d78cc976 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20251230T014957-150000.1.134.1 |
Related vulnerabilities
- GO-2025-4207 1Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers in… Same vulnerability
- GO-2025-4230 1Panel contains a cross-site request forgery (CSRF) vulnerability in the panel name… Also affects github.com/1Panel-dev/1Panel
- GO-2025-4229 1Panel contains a cross-site request forgery (CSRF) vulnerability in the Change Username… Also affects github.com/1Panel-dev/1Panel
- GO-2025-4231 1Panel contains a cross-site request forgery (CSRF) vulnerability in the web port… Also affects github.com/1Panel-dev/1Panel
- GO-2025-4209 1Panel – CAPTCHA Bypass via Client-Controlled Flag in github.com/1Panel-dev/1Panel Also affects github.com/1Panel-dev/1Panel
- CVE-2025-34430 1Panel versions 1.10.33 through 2.0.15 contain a cross-site request forgery (CSRF)… Also affects github.com/1Panel-dev/1Panel
- CVE-2025-34410 1Panel contains a cross-site request forgery (CSRF) vulnerability in the Change Username… Also affects github.com/1Panel-dev/1Panel
- CVE-2025-34429 1Panel contains a cross-site request forgery (CSRF) vulnerability in the web port… Also affects github.com/1Panel-dev/1Panel