CVE Feed

    Dashboard / CVE / CVE-2025-66507

    CVE-2025-66507

    1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.13 and below allow an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections can be bypassed, enabling automated login attempts and significantly increasing the risk of account takeover (ATO). This issue is fixed in version 2.0.14.

    Published:Dec 9, 2025
    Last Modified:Dec 10, 2025
    EPS:Dec 9, 2025
    EPSS Score:0.00088
    CVSS Score:7.5

    Affected Products

    Vendor
    1panel
    Product
    1panel
    Vendor
    Fit2cloud
    Product
    1panel
    Vendor
    Linux
    Product
    Linux

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-162 Manipulating Hidden Fields
    CAPEC-202 Create Malicious Client
    CAPEC-207 Removing Important Client Functionality
    CAPEC-208 Removing/short-circuiting 'Purse' logic: removing/mutating 'cash' decrements
    CAPEC-21 Exploitation of Trusted Identifiers
    CAPEC-22 Exploiting Trust in Client
    CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies
    CAPEC-383 Harvesting Information via API Event Monitoring
    CAPEC-384 Application API Message Manipulation via Man-in-the-Middle
    CAPEC-385 Transaction or Event Tampering via Application API Manipulation
    CAPEC-386 Application API Navigation Remapping
    CAPEC-387 Navigation Remapping To Propagate Malicious Content
    CAPEC-388 Application API Button Hijacking
    CAPEC-459 Creating a Rogue Certification Authority Certificate
    CAPEC-461 Web Services API Signature Forgery Leveraging Hash Function Extension Weakness
    CAPEC-473 Signature Spoof
    CAPEC-476 Signature Spoofing by Misrepresentation
    CAPEC-59 Session Credential Falsification through Prediction
    CAPEC-60 Reusing Session IDs (aka Session Replay)
    CAPEC-667 Bluetooth Impersonation AttackS (BIAS)
    CAPEC-94 Adversary in the Middle (AiTM)

    Related CVEs

    CVE-2026-23525 (CVSS 6.4) — 1Panel is an open-source, web-based control panel for Linux server management. A stored Cross-Site Scripting (…
    CVE-2025-34429 (CVSS 7) — 1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the web port con…
    CVE-2025-34430 (CVSS 5.1) — 1Panel versions 1.10.33 through 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the panel …
    CVE-2025-34410 (CVSS 7) — 1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the Change Usern…
    CVE-2025-66508 (CVSS 6.5) — 1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.14 and below use G…
    CVE-2025-10433 (CVSS 2.1) — A vulnerability was determined in 1Panel-dev MaxKB up to 2.0.2/2.1.0. This issue affects some unknown processi…
    CVE-2025-56413 (CVSS 8.8) — OS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing attackers to execute arbitr…
    CVE-2025-54424 (CVSS 8.1) — 1Panel is a web interface and MCP Server that manages websites, files, containers, databases, and LLMs on a Li…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High