CVE-2026-73696

The record

Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call after a header('Location: ...') redirect. Attackers can send unauthenticated requests to continue PHP execution past the redirect, reaching user panel functionality that should require authentication.

Affected packages

Related vulnerabilities

• CVE-2026-120341 A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project. CWE-698
• CVE-2026-74049 Execution After Redirect (EAR) vulnerability in Apache Tomcat. CWE-698
• CVE-2026-16323 Execution after redirect (EAR) vulnerability in FuyaWeb Internet and Informatics Services… CWE-698
• CVE-2026-61407 Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with… CWE-698
• CVE-2026-58455 Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability… CWE-698
• CVE-2026-10271 A flaw has been found in a4m4 Student-Management-System up to… CWE-698
• CVE-2026-3264 A vulnerability was determined in go2ismail Free-CRM up to… CWE-698
• CVE-2026-3262 A vulnerability has been found in go2ismail Asp.Net-Core-Inventory-Order-Management-Syste… CWE-698