PT-2025-49759 · 1Panel · 1Panel

Published 2025-12-09 · Updated 2026-01-06 · CVE-2025-66507

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions 1Panel versions 2.0.13 and below

Description 1Panel is a web-based control panel for Linux server management. Versions 2.0.13 and below allow an unauthenticated attacker to bypass CAPTCHA verification by manipulating a client-controlled parameter. The server incorrectly trusts this parameter without validation, which allows attackers to disable CAPTCHA protections. This can lead to automated login attempts and potential account takeover (ATO).

Recommendations Update to version 2.0.14 or later.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-807

CWE-602

CWE-290

Related Identifiers

CVE-2025-66507

GHSA-QMG5-V42X-QQHQ

GO-2025-4209

SUSE-SU-2026:0037-1

Affected Products

1Panel

References · 86

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66507.json · Exploit
• https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-qmg5-v42x-qqhq · Vendor Advisory
• https://github.com/1Panel-dev/1Panel/commit/ac43f00273be745f8d04b90b6e2b9c1a40ef7bca · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-66507 · Security Note
• https://osv.dev/vulnerability/GO-2025-4209 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66507 · Vendor Advisory
• https://github.com/1Panel-dev/1Panel/releases/tag/v2.0.14 · Note
• https://suse.com/security/cve/CVE-2025-68941 · Note
• https://suse.com/security/cve/CVE-2025-67508 · Note
• https://suse.com/security/cve/CVE-2025-10543 · Note
• https://suse.com/security/cve/CVE-2025-60633 · Note
• https://suse.com/security/cve/CVE-2025-68939 · Note
• https://suse.com/security/cve/CVE-2025-65637 · Note
• https://suse.com/security/cve/CVE-2025-66508 · Note