1Panel CVE-2025-66507

Exploitation requires sending a crafted request to the 1Panel authentication endpoint /api/login with the client-controlled boolean field ignoreCaptcha set to true; the pre-patch server trusted this value directly (if !req.IgnoreCaptcha) with no server-side validation, session binding, or privilege check, so CAPTCHA is skipped against default configurations of 1Panel versions 2.0.13 and below. No authentication, MFA, trusted device, IP reputation check, or prior session is needed, and the advisory notes no rate limiting exists. The key LIMITING factor is that the bypass alone grants nothing - it only disables anti-automation, so successful account takeover still depends on the attacker possessing or brute-forcing valid credentials; strong/unique admin passwords and non-exposure of the panel to untrusted networks substantially reduce realistic risk.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) correctly captures a trivially reachable, network-based, unauthenticated flaw: any client can send ignoreCaptcha: true to the /api/login endpoint and skip CAPTCHA entirely, with no complexity or interaction barriers. However, the base score of 7.5 is driven by a C:H rating that is questionable - a CAPTCHA bypass does not itself disclose confidential data; it only removes an anti-automation control and thereby enables credential brute-forcing toward account takeover. The real-world impact is therefore secondary and conditional on an attacker also guessing or cracking valid credentials, so the effective risk is lower than the 'High' label implies. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the confirmed exploit primitive is nonetheless simple and well-documented in the GitHub advisory and patch diff. Net assessment: a legitimate security-control weakness worth patching promptly on internet-exposed instances, but not an immediate drop-everything emergency absent weak/default credentials or exposure at scale. Note the signal conflict: NVD rates C:H while the described impact (bypassing an anti-brute-force control) argues for a lower direct confidentiality impact - verify severity expectations against your own deployment.

An attacker locates an internet-exposed 1Panel login page (≤2.0.13) and sends login POST requests to /api/login with the JSON field ignoreCaptcha set to true, causing the server to skip CAPTCHA validation. With the anti-automation control disabled and no rate limiting present, the attacker scripts high-volume credential guessing against the admin account, moving toward account takeover. No public exploit code was identified, but the one-line parameter abuse is fully described in the GHSA advisory.