CVE-2025-66507: 1Panel – CAPTCHA Bypass via Client-Controlled Flag

Vulnerability summary

CVE-2025-66507 is a high (CVSS 7.5) Authentication Bypass by Spoofing vulnerability in 1panel-dev 1panel. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 40.1% of scored vulnerabilities.

Timeline

1. 09-12-2025
   PublishedVulnerability first disclosed.
2. 09-12-2025
   Last modifiedVulnerability information updated.

Description

1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.13 and below allow an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections can be bypassed, enabling automated login attempts and significantly increasing the risk of account takeover (ATO). This issue is fixed in version 2.0.14.

• CWE-290Authentication Bypass by SpoofingThis attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
• CWE-602Client-Side Enforcement of Server-Side SecurityThe product includes a server that relies on the client to implement a protection mechanism that is intended to protect the server.
• CWE-807Reliance on Untrusted Inputs in a Security DecisionThe product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.