TI-2025-40929 Aliases CVE-2025-66507 GHSA-qmg5-v42x-qqhq

1Panel – CAPTCHA Bypass via Client-Controlled Flag

LOW 39CWE-290Published 2025-12-09 · Updated 2025-12-09

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-290.

Summary

1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.13 and below allow an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections can be bypassed, enabling automated login attempts and significantly increasing the risk of account takeover (ATO). This issue is fixed in version 2.0.14.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00463 40th percentileScored 2026-11-07

Fix Fixed 1Panel (1Panel-dev): 2.0.14github.com/1Panel-dev/1Panel (Go): 2.0.14+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
1Panel-dev	1Panel	before 2.0.14	2.0.14	Patch available	CNA
—	github.com/1Panel-dev/1Panel (Go)	before 2.0.14	2.0.14	Patch available	GHSA-qmg5-v42x-qqhq
—	github.com/1Panel-dev/1Panel/core (Go)	before 0.0.0-20251128030527-ac43f00273be	0.0.0-20251128030527-ac43f00273be	Patch available	GHSA-qmg5-v42x-qqhq

1Panel Vendor1Panel-dev Affected before 2.0.14 Fixed in 2.0.14 Patch available CNA
github.com/1Panel-dev/1Panel (Go) Vendor— Affected before 2.0.14 Fixed in 2.0.14 Patch available GHSA-qmg5-v42x-qqhq
github.com/1Panel-dev/1Panel/core (Go) Vendor— Affected before 0.0.0-20251128030527-ac43f00273be Fixed in 0.0.0-20251128030527-ac43f00273be Patch available GHSA-qmg5-v42x-qqhq

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:fit2cloud:1panel::::::::	before 2.0.14	Vulnerable	1Panel-dev

cpe:2.3:a:fit2cloud:1panel:*:*:*:*:*:*:*:* Versions before 2.0.14 Vulnerable ·1Panel-dev

Remediation

Fix · CNA 1Panel (1Panel-dev) Fixed in 2.0.14
Fix · GHSA-qmg5-v42x-qqhq github.com/1Panel-dev/1Panel (Go) Fixed in 2.0.14 Advisory →
Fix · GHSA-qmg5-v42x-qqhq github.com/1Panel-dev/1Panel/core (Go) Fixed in 0.0.0-20251128030527-ac43f00273be Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-66507
2026-10-03 Alias added: GHSA-qmg5-v42x-qqhq

References

Patch 1

https://github.com/1Panel-dev/1Panel/commit/ac43f00273be745f8d04b90b6e2b9c1a40ef7bca

Advisory 2

Other 2

TI-2024-26801 a sqlinjection in 1Panel CVSS 3.1CRITICAL 9.8
TI-2023-20859 1Panel arbitrary file write vulnerability exists in the background CVSS 3.1CRITICAL 9.8
TI-2025-34229 1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution CVSS 3.1CRITICAL 9.8
TI-2024-02187 1Panel swap baseApi.UpdateDeviceSwap command injection CVSS 3.1CRITICAL 9.8
TI-2025-35333 OS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing… CVSS 3.1HIGH 8.8
TI-2023-19085 Command injection in firewall ip functionality in 1Panel CVSS 3.1HIGH 8.8

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences