CVE-2025-66507

Katalog CVE

CVSS 7.5 · High EPSS 0,47%

Kerentanan Authentication Bypass by Spoofing pada fit2cloud 1panel. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.13 and below allow an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections can be bypassed, enabling automated login attempts and significantly increasing the risk of account takeover (ATO). This issue is fixed in version 2.0.14.

Rincian

Terbit di NVD

9 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-290: Authentication Bypass by Spoofing
CWE-602: Client-Side Enforcement of Server-Side Security
CWE-807: Reliance on Untrusted Inputs in a Security Decision

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 38,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-qmg5-v42x-qqhq advisory vendor
• https://github.com/1Panel-dev/1Panel/commit/ac43f00273be745f8d04b90b6e2b9c1a40ef7bca patch
• https://github.com/1Panel-dev/1Panel/releases/tag/v2.0.14 release notes