{"id":"GHSA-qmg5-v42x-qqhq","revision":"6887eb4961034bd0997997d48559b2d8","records":[{"revision":"6887eb4961034bd0997997d48559b2d8","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-qmg5-v42x-qqhq","aliases":["CVE-2025-66507","GO-2025-4209"],"title":"1Panel – CAPTCHA Bypass via Client-Controlled Flag ","description":"### Summary\n\nA CAPTCHA bypass vulnerability in the 1Panel authentication API allows an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections could be bypassed, enabling automated login attempts and significantly increasing the risk of account takeover (ATO).\n\n### Details\n\nThe /api/login endpoint accepts a boolean field named ignoreCaptcha directly from the client request body:\n\n`\"ignoreCaptcha\": true`\n\n\nThe backend implementation uses this value to determine whether CAPTCHA validation should be performed:\n\n```\nif !req.IgnoreCaptcha {\n    if errMsg := captcha.VerifyCode(req.CaptchaID, req.Captcha); errMsg != \"\" {\n        helper.BadAuth(c, errMsg, nil)\n        return\n    }\n}\n\n```\n\nBecause req.IgnoreCaptcha is taken directly from user input—with no server-side validation, no session binding, and no privilege checks—any unauthenticated attacker can force CAPTCHA validation to be skipped.\n\nThere are no additional conditions, such as:\n\nno requirement for MFA\n\nno trusted device\n\nno IP reputation checks\n\nno prior valid session\n\nno rate limiting\n\nThis results in CAPTCHA being entirely client-controlled, which violates fundamental authentication and anti-automation security assumptions.","state":0,"publishedAt":"2025-12-08T17:56:27+00:00","modifiedAt":"2025-12-15T19:56:03.279253+00:00","affected":[{"ecosystem":"Go","name":"github.com/1Panel-dev/1Panel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.0.14"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/1Panel-dev/1Panel/core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20251128030527-ac43f00273be"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-qmg5-v42x-qqhq","https://nvd.nist.gov/vuln/detail/CVE-2025-66507","https://github.com/1Panel-dev/1Panel/commit/ac43f00273be745f8d04b90b6e2b9c1a40ef7bca","https://github.com/1Panel-dev/1Panel","https://github.com/1Panel-dev/1Panel/releases/tag/v2.0.14"],"sourceUrl":"https://github.com/advisories/GHSA-qmg5-v42x-qqhq","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-qmg5-v42x-qqhq","identifiers":["GHSA-qmg5-v42x-qqhq","CVE-2025-66507","GO-2025-4209"]},"retained":false,"historicalAffected":[]}],"coverage":[]}