Description

Execution after redirect (EAR) vulnerability in FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel allows Authentication Bypass. This issue affects ArchitectPanel Web Admin Panel: through 28072026.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-21T08:16:42.667Z",
  "pubdate": "2026-08-21T08:16:42.667Z",
  "executiveSummary": "An Execution After Redirect (EAR) vulnerability exists in the FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel through 28072026. This security flaw enables remote unauthenticated attackers to achieve an Authentication Bypass and interact with restricted administrative functionality without proper credential verification.\nThe vulnerability stems from improper handling of program execution flow following an HTTP redirection header issuance. While the application attempts to redirect unauthorized clients away from protected administrative endpoints, the underlying code logic continues to process the subsequent execution instructions rather than terminating the request lifecycle immediately. Consequently, an attacker can bypass the intended access control barrier simply by ignoring the redirection response or intercepting the control flow.\nSuccessful exploitation of this vulnerability grants unauthorized users full administrative access to the ArchitectPanel Web Admin Panel, undermining the confidentiality, integrity, and availability of the underlying web application. The risk implications are severe, potentially leading to total system compromise, unauthorized data exposure, and administrative control takeover. No specific attacker privileges are required, and the exploitation vector is network-accessible, presenting a high-risk security posture for deployments utilizing the affected product versions.",
  "technicalDetails": "The vulnerability is classified as an Execution After Redirect (EAR) flaw, located within the authorization enforcement mechanisms of the FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel through 28072026.\nThe root cause of this vulnerability lies in the asynchronous or sequential processing model of the web application framework. When an unauthenticated HTTP request reaches a protected administrative resource or function within the ArchitectPanel Web Admin Panel, the server-side logic issues an HTTP redirect header (such as Location: login.php) instructing the client browser to navigate to an authentication page.\nHowever, the application fails to explicitly terminate execution of the current script immediately after sending the redirect header. Because the server continues executing the remaining lines of code in the request handler, the security checks designed to prevent unauthorized access are effectively bypassed. The restricted content or administrative action is processed and rendered to the client regardless of the intended redirection.\nThe attack flow proceeds as follows: First, an unauthenticated attacker sends an HTTP request directly to a protected endpoint within the ArchitectPanel Web Admin Panel over the network. Second, the vulnerable server-side script evaluates the missing or invalid session state and transmits an HTTP redirect response to the client alongside the execution continuation flag. Third, rather than halting execution, the script proceeds to execute the restricted logic or render the administrative interface. Fourth, the attacker captures or reads the response payload containing the sensitive administrative interface or functional output, thereby completing the Authentication Bypass.\nThe vulnerable component involves the session validation and access control routing logic within the web admin panel. The exploitation vector is network-exposed, requiring no prior authentication or administrative privilege levels. Post-exploitation impact includes full administrative capability, unauthorized data modification, potential remote code execution depending on subsequent administrative functionality, and total compromise of the affected web application instance."
}