CVE-2026-77879: access_token() OAuth gate SQL injection
SQL injection in the user API access_token() gate lets an attacker forge a valid auth row and reach root command-execution routes such as /v1/newpass/.
Executive Summary & Technical Impact
SQL injection in the user API access_token() gate lets an attacker forge a valid auth row and reach root command-execution routes such as /v1/newpass/.
Tracked under CVE-2026-77879 (CWE-89 (SQL Injection)), this vulnerability affects CWP before 1.16 and carries a severity score of 8.8 (HIGH). Engineering and security operations teams running Control Web Panel (CWP) user API should prioritize upgrading to CWP 1.16 (prepared statement on access_token gate).
Remediation & Patch Guidance
- Upgrade to CWP 1.29 or later.
Frequently Asked Questions (CVE-2026-77879)
What versions are affected by CVE-2026-77879?
CVE-2026-77879 affects CWP before 1.16 in Control Web Panel (CWP) user API (access_token() OAuth gate SQL injection).
How do I patch or remediate CVE-2026-77879?
Upgrade affected deployments to CWP 1.16 (prepared statement on access_token gate) and verify the remediation steps listed above.
What is the CVSS score of CVE-2026-77879?
CVE-2026-77879 is rated HIGH with a CVSS score of 8.8 (vector: Local loopback; UNION forges auth gate into guarded root routes).
