CVE-2026-73696: unauthenticatedFlow() / toLoginWithIntendedUri() missing exit()
Execution-after-redirect in CWP user-panel unauthenticated flow. The login Location header is set without exit(), so control falls through to the attacker-controlled module include. Fixed in CWP 1.12; remaining root API sinks closed later in 1.27/1.29.
Executive Summary & Technical Impact
Execution-after-redirect in CWP user-panel unauthenticated flow. The login Location header is set without exit(), so control falls through to the attacker-controlled module include. Fixed in CWP 1.12; remaining root API sinks closed later in 1.27/1.29.
Tracked under CVE-2026-73696 (CWE-698 (Execution After Redirect)), this vulnerability affects CWP before 1.12 and carries a severity score of 9.8 (enabler of pre-auth stage) (CRITICAL). Engineering and security operations teams running Control Web Panel (CWP) user panel should prioritize upgrading to CWP 1.12+ (exit after redirect); full chain closed in 1.29+.
Remediation & Patch Guidance
- Upgrade to CWP 1.29 or later.
- Do not treat a cosmetic 302 from /login as proof the panel is safe.
Frequently Asked Questions (CVE-2026-73696)
What versions are affected by CVE-2026-73696?
CVE-2026-73696 affects CWP before 1.12 in Control Web Panel (CWP) user panel (unauthenticatedFlow() / toLoginWithIntendedUri() missing exit()).
How do I patch or remediate CVE-2026-73696?
Upgrade affected deployments to CWP 1.12+ (exit after redirect); full chain closed in 1.29+ and verify the remediation steps listed above.
What is the CVSS score of CVE-2026-73696?
CVE-2026-73696 is rated CRITICAL with a CVSS score of 9.8 (enabler of pre-auth stage) (vector: Network, unauthenticated; 302 to /login does not stop PHP, so module include still runs).
