CVE-2025-66507: Fit2cloud 1Panel Auth Bypass Vulnerability

CVE-2025-66507 Overview

1Panel is an open-source, web-based control panel for Linux server management. CVE-2025-66507 affects versions 2.0.13 and below, where an unauthenticated attacker can disable CAPTCHA verification by abusing a client-controlled parameter. The server previously trusted the ignoreCaptcha value sent by the client without proper validation. This enables attackers to bypass CAPTCHA protections and automate login attempts against the panel. The flaw is categorized as Authentication Bypass [CWE-290] and is fixed in version 2.0.14.

Critical Impact

Unauthenticated attackers can bypass CAPTCHA protections on the 1Panel login endpoint, enabling automated credential stuffing and brute-force attacks that significantly increase account takeover (ATO) risk.

Affected Products

• Fit2cloud 1Panel versions 2.0.13 and below
• 1Panel core authentication API (core/app/api/v2/auth.go)
• 1Panel login DTO accepting ignoreCaptcha flag (core/app/dto/auth.go)

Discovery Timeline

• 2025-12-09 - CVE-2025-66507 published to NVD
• 2025-12-10 - Last updated in NVD database

Technical Details for CVE-2025-66507

Vulnerability Analysis

The vulnerability resides in the 1Panel login API logic. The Login request structure accepted an IgnoreCaptcha boolean field directly from the client request body. When the server processed the login flow, it honored this client-supplied flag to skip CAPTCHA verification entirely. An attacker can craft a login request with ignoreCaptcha: true and submit unlimited authentication attempts without solving any challenge. This converts the login endpoint into an unrestricted brute-force target. Combined with weak or reused credentials, the bypass directly enables account takeover of administrator accounts that control underlying Linux servers.

Root Cause

The root cause is improper trust of client-supplied input on an authentication boundary [CWE-290]. The IgnoreCaptcha field allowed the requester to dictate whether a security control applied. CAPTCHA enforcement decisions must be made server-side based on session state, request history, or risk signals — never a flag the caller controls.

Attack Vector

The attack is remote, unauthenticated, and requires no user interaction. An attacker sends HTTP POST requests to the login endpoint with ignoreCaptcha set to true and iterates through username and password combinations. No CAPTCHA challenge is issued or validated, allowing high-throughput automation against the panel.

// Patch in core/app/dto/auth.go - perf: optimize login API logic (#11104)
 type Login struct {
-	Name          string `json:"name" validate:"required"`
-	Password      string `json:"password" validate:"required"`
-	IgnoreCaptcha bool   `json:"ignoreCaptcha"`
-	Captcha       string `json:"captcha"`
-	CaptchaID     string `json:"captchaID"`
-	Language      string `json:"language" validate:"required,oneof=zh en 'zh-Hant' ko ja ru ms 'pt-BR' tr 'es-ES'"`
+	Name      string `json:"name" validate:"required"`
+	Password  string `json:"password" validate:"required"`
+	Captcha   string `json:"captcha"`
+	CaptchaID string `json:"captchaID"`
+	Language  string `json:"language" validate:"required,oneof=zh en 'zh-Hant' ko ja ru ms 'pt-BR' tr 'es-ES'"`
 }

Source: GitHub Commit ac43f00. The patch removes the IgnoreCaptcha field entirely, eliminating the client's ability to opt out of CAPTCHA enforcement.

Detection Methods for CVE-2025-66507

Indicators of Compromise

• HTTP POST requests to the 1Panel login endpoint containing the JSON field "ignoreCaptcha":true.
• High volume of login attempts from a single source IP or distributed botnet against /api/v2/auth style routes.
• Successful authentication events following bursts of failed login attempts that lack any preceding CAPTCHA validation requests.

Detection Strategies

• Inspect web server, reverse proxy, or WAF logs for request bodies containing ignoreCaptcha set to true against 1Panel login routes.
• Correlate authentication failure spikes with the absence of CAPTCHA-related endpoint calls (for example, /captcha or captchaID issuance) preceding login attempts.
• Alert on administrator logins originating from new geolocations, ASNs, or user-agents not previously associated with the account.

Monitoring Recommendations

• Enable verbose access logging for all 1Panel authentication endpoints and forward logs to a centralized SIEM or data lake for retention and analytics.
• Implement rate-limiting and IP-based throttling at the reverse proxy in front of 1Panel.
• Monitor for outbound activity from the 1Panel host following successful logins, including new SSH keys, scheduled tasks, or container deployments.

How to Mitigate CVE-2025-66507

Immediate Actions Required

• Upgrade 1Panel to version 2.0.14 or later, which removes the IgnoreCaptcha field from the login request structure.
• Restrict network access to the 1Panel management interface using firewall rules, VPN, or zero-trust network access.
• Rotate administrator credentials and any API tokens issued by the panel if version 2.0.13 or earlier was exposed to untrusted networks.
• Enable multi-factor authentication (MFA) on all 1Panel administrator accounts to limit the impact of credential compromise.

Patch Information

The fix is available in 1Panel v2.0.14. The patch in commit ac43f00273be745f8d04b90b6e2b9c1a40ef7bca removes the client-controlled IgnoreCaptcha field from the Login DTO so CAPTCHA validation is always enforced server-side. See the GitHub Security Advisory GHSA-qmg5-v42x-qqhq and the GitHub Release v2.0.14 for full details.

Workarounds

• Place the 1Panel interface behind an authenticating reverse proxy that enforces its own MFA or client certificate requirements until the upgrade is applied.
• Deploy a WAF rule that blocks any request to login endpoints containing ignoreCaptcha in the JSON body.
• Apply strict rate limiting on login endpoints to slow automated credential stuffing while patching is scheduled.

# Example NGINX rule to block requests carrying the ignoreCaptcha flag
location /api/ {
    if ($request_body ~* "ignoreCaptcha\s*:\s*true") {
        return 403;
    }
    limit_req zone=login burst=5 nodelay;
    proxy_pass http://1panel_backend;
}

# Define rate-limit zone in the http {} block
# limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;