CVE Alert: CVE-2026-124020 – Control Web Panel

Control Web Panel (CWP) before webpanel_version 1.30.6 contains a host header injection vulnerability that allows unauthenticated attackers to manipulate the password-recovery reset URL by injecting the HTTP Host header into the /v1/lostpass/ route’s token generation process. Attackers can lure an automated mail-security scanner into visiting the poisoned reset link to exfiltrate the live recovery token, replay it at /login/index.php?acc=newpass to set a new password, and subsequently abuse the File Manager and Crontab modules to achieve command execution as the targeted hosting account.

**Risk verdict:** This is a serious account-compromise risk for exposed hosting panels; urgency is elevated, but no active exploitation or KEV status is established by the supplied data.

**Why this matters:** A successful attack could let an unauthenticated outsider take over a hosting account and affect its files, scheduled tasks and hosted services. That creates realistic risks of website defacement, malware delivery, data theft or disruption, and could provide a foothold for further attacks.

**Most likely attack path:** The panel is reachable over the network, with no account or victim action required at the initial request; exploitation nevertheless depends on a relevant condition, and the supplied account indicates a poisoned recovery flow involving automated mail inspection. The likely result is control of the targeted hosting account, rather than direct impact on other systems; broader movement would depend on shared credentials, infrastructure or weak tenant isolation.

**Who is most exposed:** Internet-facing hosting providers, resellers and organisations using the panel to manage multiple customer sites are the main concern. Exposure is higher where recovery emails are automatically inspected or followed.

Alert on password-reset requests with unexpected or inconsistent Host values.

Review reset-email scanner visits followed by rapid password changes.

Investigate unusual file-manager activity or newly created scheduled tasks after account recovery.

Check for unexpected outbound connections or changes to hosted content.

Mitigation and prioritisation:

Upgrade promptly to a vendor-fixed release; prioritise internet-facing systems.

Until patched, restrict panel access to trusted networks and disable recovery if operationally feasible.

Ensure generated recovery links use a trusted, fixed hostname; review scanner handling of reset emails.

Apply changes through normal change control, then verify recovery workflows and audit affected accounts.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.