UpHeron
All vulnerabilities

Servers and applications

CVE-2026-124020

Control Web Panel < 1.30.6 Host Header Password Reset Poisoning

Severity
Critical 9.2
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
1.30.6
Weakness
Weak password recovery (CWE-640)
Attack
Over the network · Only under certain conditions · No login needed · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Sources
CVE Program

Description

Control Web Panel (CWP) before webpanel_version 1.30.6 contains a host header injection vulnerability that allows unauthenticated attackers to manipulate the password-recovery reset URL by injecting the HTTP Host header into the /v1/lostpass/ route's token generation process. Attackers can lure an automated mail-security scanner into visiting the poisoned reset link to exfiltrate the live recovery token, replay it at /login/index.php?acc=newpass to set a new password, and subsequently abuse the File Manager and Crontab modules to achieve command execution as the targeted hosting account.

From the CVE Program.

Affected software

SoftwareAffected versions
Control Web PanelServers and applications · cna:control web panel|control web panel
  • Every version before 1.30.6

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-124020