Control Web Panel Authentication Bypass via Execution After Redirect

Control Web Panel (CWP) versions before webpanel_version 1.12 contain an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex).

An unauthenticated attacker can bypass authentication by exploiting a missing exit() call after a header('Location: ...') redirect. Because PHP execution continues past the redirect, unauthenticated requests can proceed.

This allows attackers to reach functionality that should require authentication.