# CVE-2025-66507: 1Panel — Fixed in 2.0.14

🐹

🐹 Go

Not in CISA KEV

HIGH severity

# CVE-2025-66507 — 1Panel

HIGH [Fix: 1Panel-dev/1Panel@ac43f00](https://github.com/1Panel-dev/1Panel/commit/ac43f00273be745f8d04b90b6e2b9c1a40ef7bca)

CVE-2025-66507 is a high-severity (CVSS 7.5) CWE-290 vulnerability in github.com/1Panel-dev/1Panel. A fix is available for github.com/1Panel-dev/1Panel — see the affected versions and patch details below.

1Panel – CAPTCHA Bypass via Client-Controlled Flag

Also known as[GHSA-qmg5-v42x-qqhq](/vulnerability/GHSA-qmg5-v42x-qqhq)GO-2025-4209

Published

Dec 9, 2025

Updated

Oct 28, 2026

Affected

2 pkgs

Patched

2 / 2

Exploits

None indexed

Exploitation data as of Nov 8, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## Exploitation Status

### No confirmed exploitation observed yet

-   CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
-   CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2025-66507.

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

0.5%probability of exploitation in next 30 days

Lower Risk\-0.00%

Lower risk than most CVEs40th percentile — riskier than 40% of all scored CVEsHighest risk

0.00%0.32%0.64%0.97%0.2%0.5%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## How urgent is this, really

## Where this sits among everything scored

## Real-World Exposure

2 pkgs affected

🐹`github.com/1Panel-dev/1Panel`🐹`github.com/1Panel-dev/1Panel/core`

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

## Description

#### Summary

A CAPTCHA bypass vulnerability in the 1Panel authentication API allows an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections could be bypassed, enabling automated login attempts and significantly increasing the risk of account takeover (ATO).

#### Details

The /api/login endpoint accepts a boolean field named ignoreCaptcha directly from the client request body:

`"ignoreCaptcha": true`

The backend implementation uses this value to determine whether CAPTCHA validation should be performed:

```
if !req.IgnoreCaptcha {
    if errMsg := captcha.VerifyCode(req.CaptchaID, req.Captcha); errMsg != "" {
        helper.BadAuth(c, errMsg, nil)
        return
    }
}

```

Because req.IgnoreCaptcha is taken directly from user input—with no server-side validation, no session binding, and no privilege checks—any unauthenticated attacker can force CAPTCHA validation to be skipped.

There are no additional conditions, such as:

no requirement for MFA

no trusted device

no IP reputation checks

no prior valid session

no rate limiting

This results in CAPTCHA being entirely client-controlled, which violates fundamental authentication and anti-automation security assumptions.

## Affected Packages

2 total 2 fixed

Ecosystem

Package

Vulnerable range

Fix

🐹Go

`github.com/1Panel-dev/1Panel` 

all versions

2.0.14`go get github.com/1Panel-dev/1Panel@v2.0.14`

🐹Go

`github.com/1Panel-dev/1Panel/core` 

all versions

0.0.0-20251128030527-ac43f00273be`go get github.com/1Panel-dev/1Panel/core@v0.0.0-20251128030527-ac43f00273be`

## Affected Products

1 product · 1 configurations

Application

`1panel`fit2cloud

< 2.0.14

range

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/1Panel-dev/1Panel, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    Update github.com/1Panel-dev/1Panel to 2.0.14 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-66507 is resolved across your whole dependency graph.
    
3.  ### Workarounds
    
    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
    

## Frequently Asked Questions

\### Summary A CAPTCHA bypass vulnerability in the 1Panel authentication API allows an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections could be bypassed, enabling automated login attempts and significantly increasing the risk of account takeover (ATO). ### Details The /api/login endpoint accepts a boolean field named ignoreCaptcha directly from the client request body: \`"ignoreCaptcha": true\` The backend implementation uses this value to determ

O3 Security · Impact-Aware SCA

### Is CVE-2025-66507 in your dependencies?

Find it across Go, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)