CVE-2025-66507

Timeline

Detection, updates, and resolution for this record.

1. Dec 9, 2025 · NIST NVD

   Detected

   1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.13 and below allow an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections can be bypassed, enabling automated login attempts and significantly increasing the risk of

2. Oct 14, 2026 · NIST NVD

   Updated

   1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.13 and below allow an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections can be bypassed, enabling automated login attempts and significantly increasing the risk of

Affected

• cpe fit2cloud/1panelversion unspecified

Sources

• CVE.orgCVE-2025-66507

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2025-66507

  30-day exploitation probability 0.5%

  first.org
• NIST NVDCVE-2025-66507

  1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.13 and below allow an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper val

  nvd.nist.gov

References

• Patch · github.com
• Release Notes · github.com
• Vendor Advisory · github.com