This vulnerability affects the embedded HTTP server in Panabit PAP-XM320 devices up to and including version 7.7. The server uses a filesystem existence check to validate session cookies, but it does not sanitize the cookie values properly. This improper validation enables directory traversal attacks, allowing an attacker to bypass authentication mechanisms. The vulnerability was published in May 2026, with no CVSS score or remediation details provided. The affected product is not a cloud service, and no known exploits have been reported.

Successful exploitation of this vulnerability allows an attacker to bypass authentication on the affected device's embedded HTTP server. This could potentially grant unauthorized access to the device's management interface or other protected resources. The exact impact depends on the device's role and configuration but generally represents a significant security risk due to unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected device's management interface to trusted networks and users only. Monitor for vendor updates regarding patches or official mitigations.