CVE-2025-34429

1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality. The port-change endpoint lacks CSRF defenses such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that submits a port-change request; when a victim visits it while authenticated, the browser includes valid session cookies and the request succeeds. This allows an attacker to change the port on which the 1Panel web service listens, causing loss of access on the original port and resulting in service disruption or denial of service, and may unintentionally expose the service on an attacker-chosen port.

• CWE-352

• https://1panel.pro/Product
• https://github.com/1Panel-dev/1Panel/releasesProduct, Release Notes
• https://www.vulncheck.com/advisories/1panel-csrf-web-port-configuration-changeThird Party Advisory

Published

Dec 10, 2025

Last Modified

Jul 14, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-34423MailEnable versions prior to 10.54 contain an unsafe DLL loa…7.8
• CVE-2025-34424MailEnable versions prior to 10.54 contain an unsafe DLL loa…7.8
• CVE-2025-34425MailEnable versions prior to 10.54 contain a reflected cross…6.1
• CVE-2025-34426Rejected reason: This CVE ID was rejected because it was res…
• CVE-2025-34427MailEnable versions prior to 10.54 contain a cleartext stora…7.8
• CVE-2025-34428MailEnable versions prior to 10.54 contain a cleartext stora…7.8
• CVE-2025-344301Panel versions 1.10.33 through 2.0.15 contain a cross-site …4.3
• CVE-2025-34431Rejected reason: This CVE ID was rejected because it was res…
• CVE-2025-34432Rejected reason: This CVE ID was rejected because it was res…
• CVE-2025-34433AVideo versions 14.3.1 prior to 20.1 contain an unauthentica…9.3
• CVE-2025-34434AVideo versions prior to 20.1 with the ImageGallery plugin e…9.1
• CVE-2025-34435AVideo versions prior to 20.1 are vulnerable to an insecure …6.5