CVE-2026-73696 — Control Web Panel (CWP) < 1.12: Execution After Redirect in CWPUserIndex

Control Web Panel versions before 1.12 contain an Execution After Redirect vulnerability in the user-panel authentication flow. An attacker with a valid hosting username can bypass authentication and reach user-panel module code paths, potentially enabling a pre-authentication chain to root access.