{"schema_version":"1.7.3","id":"GHSA-qmg5-v42x-qqhq","published":"2025-12-08T17:56:27Z","modified":"2025-12-15T19:56:03.279253Z","aliases":["CVE-2025-66507","GO-2025-4209"],"summary":"1Panel – CAPTCHA Bypass via Client-Controlled Flag ","details":"### Summary\n\nA CAPTCHA bypass vulnerability in the 1Panel authentication API allows an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections could be bypassed, enabling automated login attempts and significantly increasing the risk of account takeover (ATO).\n\n### Details\n\nThe /api/login endpoint accepts a boolean field named ignoreCaptcha directly from the client request body:\n\n`\"ignoreCaptcha\": true`\n\n\nThe backend implementation uses this value to determine whether CAPTCHA validation should be performed:\n\n```\nif !req.IgnoreCaptcha {\n    if errMsg := captcha.VerifyCode(req.CaptchaID, req.Captcha); errMsg != \"\" {\n        helper.BadAuth(c, errMsg, nil)\n        return\n    }\n}\n\n```\n\nBecause req.IgnoreCaptcha is taken directly from user input—with no server-side validation, no session binding, and no privilege checks—any unauthenticated attacker can force CAPTCHA validation to be skipped.\n\nThere are no additional conditions, such as:\n\nno requirement for MFA\n\nno trusted device\n\nno IP reputation checks\n\nno prior valid session\n\nno rate limiting\n\nThis results in CAPTCHA being entirely client-controlled, which violates fundamental authentication and anti-automation security assumptions.","affected":[{"package":{"name":"github.com/1Panel-dev/1Panel","ecosystem":"Go","purl":"pkg:golang/github.com/1Panel-dev/1Panel"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.14"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-qmg5-v42x-qqhq/GHSA-qmg5-v42x-qqhq.json"}},{"package":{"name":"github.com/1Panel-dev/1Panel/core","ecosystem":"Go","purl":"pkg:golang/github.com/1Panel-dev/1Panel/core"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20251128030527-ac43f00273be"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-qmg5-v42x-qqhq/GHSA-qmg5-v42x-qqhq.json"}}],"references":[{"type":"WEB","url":"https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-qmg5-v42x-qqhq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66507"},{"type":"WEB","url":"https://github.com/1Panel-dev/1Panel/commit/ac43f00273be745f8d04b90b6e2b9c1a40ef7bca"},{"type":"PACKAGE","url":"https://github.com/1Panel-dev/1Panel"},{"type":"WEB","url":"https://github.com/1Panel-dev/1Panel/releases/tag/v2.0.14"}],"database_specific":{"cwe_ids":["CWE-290","CWE-602","CWE-807"],"github_reviewed":true,"github_reviewed_at":"2025-12-08T17:56:27Z","nvd_published_at":"2025-12-09T16:18:19Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}