{"id":"CVE-2025-66507","aliases":["GHSA-qmg5-v42x-qqhq","GO-2025-4209"],"url":"https://o3.security/vulnerability/CVE-2025-66507","summary":"1Panel – CAPTCHA Bypass via Client-Controlled Flag","details":"### Summary\n\nA CAPTCHA bypass vulnerability in the 1Panel authentication API allows an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections could be bypassed, enabling automated login attempts and significantly increasing the risk of account takeover (ATO).\n\n### Details\n\nThe /api/login endpoint accepts a boolean field named ignoreCaptcha directly from the client request body:\n\n`\"ignoreCaptcha\": true`\n\n\nThe backend implementation uses this value to determine whether CAPTCHA validation should be performed:\n\n```\nif !req.IgnoreCaptcha {\n    if errMsg := captcha.VerifyCode(req.CaptchaID, req.Captcha); errMsg != \"\" {\n        helper.BadAuth(c, errMsg, nil)\n        return\n    }\n}\n\n```\n\nBecause req.IgnoreCaptcha is taken directly from user input—with no server-side validation, no session binding, and no privilege checks—any unauthenticated attacker can force CAPTCHA validation to be skipped.\n\nThere are no additional conditions, such as:\n\nno requirement for MFA\n\nno trusted device\n\nno IP reputation checks\n\nno prior valid session\n\nno rate limiting\n\nThis results in CAPTCHA being entirely client-controlled, which violates fundamental authentication and anti-automation security assumptions.","published":"2025-12-09T01:25:48.140Z","modified":"2026-08-12T03:51:44.460348373Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":{"score":0.00456,"percentile":0.38065,"asOf":"2026-08-20"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/1Panel-dev/1Panel","fixedVersion":"2.0.14"},{"ecosystem":"Go","name":"github.com/1Panel-dev/1Panel/core","fixedVersion":"0.0.0-20251128030527-ac43f00273be"}],"fix":{"url":"https://github.com/1Panel-dev/1Panel/commit/ac43f00273be745f8d04b90b6e2b9c1a40ef7bca","label":"1Panel-dev/1Panel@ac43f00"},"references":[{"type":"WEB","url":"https://github.com/1Panel-dev/1Panel/releases/tag/v2.0.14"},{"type":"ADVISORY","url":"https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-qmg5-v42x-qqhq"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66507.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66507"},{"type":"FIX","url":"https://github.com/1Panel-dev/1Panel/commit/ac43f00273be745f8d04b90b6e2b9c1a40ef7bca"},{"type":"PACKAGE","url":"https://github.com/1Panel-dev/1Panel"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:44.460348373Z"}}