Is CVE-2026-73696 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-73696?

CVE-2026-73696 has a CVSS v3 severity of CRITICAL (9.1).

Back

CVE-2026-73696

Description

Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call after a header('Location: ...') redirect. Attackers can send unauthenticated requests to continue PHP execution past the redirect, reaching user panel functionality that should require authentication.