CVE-2024-30257: 1Panel's password verification is suspected to have a timing attack vulnerability

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-18 · updated 2026-06-17
Weakness: CWE-203

Description

1Panel is an open source Linux server operation and maintenance management panel. The password verification in the source code uses the != symbol instead hmac.Equal. This may lead to a timing attack vulnerability. This vulnerability is fixed in 1.10.3-lts.

Affected products

1Panel-dev 1Panel: before 1.10.3-lts — fixed in 1.10.3-lts

How to fix

Upgrade to a fixed version: 1Panel-dev 1Panel 1.10.3-lts. Check the vendor advisory for mitigations.

References

https://github.com/1Panel-dev/1Panel/blob/dev/backend/app/service/auth.go#L81C5-L81C26
https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-6m9h-2pr2-9j8f
https://github.com/1Panel-dev/1Panel/blob/dev/backend/app/service/auth.go#L81C5-L81C26
https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-6m9h-2pr2-9j8f

Get alerted when CVE-2024-30257 or the next vulnerability affects your stack