ControlServlet is the Apache OFBiz request router: a servlet that receives HTTP traffic and dispatches it to the correct application action or controller mapping. It sits close to the boundary between the web server and business logic, so it is often part of the first trust decision a request must pass.
In security terms, that makes ControlServlet important. If routing rules, authentication checks, or authorization logic are inconsistent, an attacker may reach sensitive actions before a valid session is established. That can turn a normal web request into pre-authentication access to administrative functions or, in severe cases, server-side code execution. Defenders should review which URLs the servlet accepts, how it handles forwarded or alternate paths, and whether every mapped action is protected by explicit access control. Custom extensions and SSO or token checks should be validated separately, not assumed safe because they sit behind the login page.