EUVD-2026-63825
GHSA-6g9g-vxr2-9mwv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Admin panel is network-accessible with no auth required due to EAR bypass; only confidentiality is impacted as attackers read protected content without modifying application state.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
2DescriptionCVE.org
Execution after redirect (EAR) vulnerability in FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel allows Authentication Bypass.
This issue affects ArchitectPanel Web Admin Panel: through 28072026.
AnalysisAI
Execution After Redirect (EAR) in FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel enables unauthenticated network attackers to bypass authentication controls and access protected administrative content through version 28072026. The flaw exploits a server-side logic error where HTTP redirect responses intended to gate access to the login page continue executing and rendering protected page content, which an attacker can read before following the redirect. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special configuration or elevated privileges are required per the CVSS vector (PR:N, AC:L, AV:N, UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a high-severity finding: network-reachable, no authentication required, low attack complexity, and high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No exact patched version is confirmed in the available input data; the vendor advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0882 should be consulted immediately for patch availability and upgrade instructions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: restrict network access to ArchitectPanel to administrative networks only through firewall rules, enable comprehensive logging of all access to the ArchitectPanel login and admin pages, and document which systems or data this instance manages. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-698 – Execution After Redirect (EAR)
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today