What’s Vulnerable › Vulnerabilities

CVE-2025-66507: 1Panel – CAPTCHA Bypass via Client-Controlled Flag

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-09 · updated 2026-10-14
• Weakness: CWE-290

Description

1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.13 and below allow an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections can be bypassed, enabling automated login attempts and significantly increasing the risk of account takeover (ATO). This issue is fixed in version 2.0.14.

Affected products

• 1Panel-dev 1Panel: before 2.0.14 — fixed in 2.0.14

How to fix

Upgrade to a fixed version: 1Panel-dev 1Panel 2.0.14. Check the vendor advisory for mitigations.

References

• https://github.com/1Panel-dev/1Panel/commit/ac43f00273be745f8d04b90b6e2b9c1a40ef7bca
• https://github.com/1Panel-dev/1Panel/releases/tag/v2.0.14
• https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-qmg5-v42x-qqhq

Get alerted when CVE-2025-66507 or the next vulnerability affects your stack