Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-66507

Good to know:

icon
icon

Date: December 9, 2025

1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.13 and below allow an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections can be bypassed, enabling automated login attempts and significantly increasing the risk of account takeover (ATO). This issue is fixed in version 2.0.14.

Severity Score

Related Resources (6)

https://nvd.nist.gov/vuln/detail/CVE-2025-66507
https://github.com/1Panel-dev/1Panel/commit/ac43f00273be745f8d04b90b6e2b9c1a40ef7bca
https://github.com/1Panel-dev/1Panel
https://github.com/1Panel-dev/1Panel/releases/tag/v2.0.14
https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-qmg5-v42x-qqhq
https://www.mend.io/vulnerability-database/CVE-2025-66507

Severity Score

Weakness Type (CWE)

Authentication Bypass by Spoofing

CWE-290

Client-Side Enforcement of Server-Side Security

CWE-602

Reliance on Untrusted Inputs in a Security Decision

CWE-807

Top Fix

icon

Upgrade Version

Upgrade to version github.com/1Panel-dev/1Panel - v2.0.14;github.com/1Panel-dev/1Panel/core - v0.0.0-20251128030527-ac43f00273be

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us