CVE-2025-70758

chetans9 core-php-admin-panel through commit a94a780d6 contains an authentication bypass vulnerability in includes/auth_validate.php

High · published February 3, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
52.7
In the wild
Unconfirmed
What it is

⚡ An authentication bypass is lurking in core-php-admin-panel, allowing attackers to slip past security measures without breaking a sweat! Think of it like a bouncer who lets anyone into a VIP lounge but forgets to check their IDs — if they don’t follow up and send them out, anyone can party with the elite! This vulnerability could allow remote attackers to gain unauthorized access to protected pages and sensitive customer data. Imagine the chaos if malicious users could peek into confidential information like they’re browsing a catalog of exclusive VIP access!

Put simply

Think of it like a bouncer who lets anyone into a VIP lounge but forgets to check their IDs — if they don’t follow up and send them out, anyone can party with the elite! In the core-php-admin-panel, an authentication bypass occurs because the application sends an HTTP redirect to the login page without terminating the script with an exit call. This flaw permits unauthenticated users to access restricted content inadvertently.

What to do

This vulnerability could allow remote attackers to gain unauthorized access to protected pages and sensitive customer data. Imagine the chaos if malicious users could peek into confidential information like they’re browsing a catalog of exclusive VIP access! To protect your application, update core-php-admin-panel to the latest version that addresses this vulnerability. Additionally, ensure that the authentication mechanism properly validates user sessions and that all redirects are followed by an exit statement to prevent unauthorized access. You’ve got this! Implement these fixes, and you’ll be back to superhero status in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00703 · 52.7th percentile
Published
2026-02-03T00:00Z
EPSS history
Timeline
  • 03 FEB 00:00Z
    chetans9 core-php-admin-panel through commit a94a780d6 contains an authentication bypass vulnerability in includes/auth_validate.php
    cvelistv5