High severity · published Dec 9, 2025
CVE-2025-66507
1Panel – CAPTCHA Bypass via Client-Controlled Flag
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.13 and below allow an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections can be bypassed, enabling automated login attempts and significantly increasing the risk of account takeover (ATO). This issue is fixed in version 2.0.14.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
1P
1Panel · 1Panel-dev
< 2.0.14 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-66507
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-66507
Patch
https://github.com/1Panel-dev/1Panel/commit/ac43f00273be745f8d04b90b6e2b9c1a40ef7bca
Release Notes
https://github.com/1Panel-dev/1Panel/releases/tag/v2.0.14
Vendor Advisory
https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-qmg5-v42x-qqhq
More from 1Panel
9.8
CVE-2025-54424
1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution
9.8
CVE-2024-39911
1Panel SQL injection
9.8
CVE-2024-39907
a sqlinjection in 1Panel
8.4
CVE-2026-23525
1panel App Store vulnerable to Cross-site Scripting
7.5
CVE-2024-34352
Arbitrary file write vulnerability in 1Panel