Loading CVE intelligence

CVE-2026-41940

CriticalPublished

WebPros cPanel and WHM Authentication Bypass via Login Flow

Published: Apr 29, 2026
Updated: Aug 11, 2026
Assigning CNA: VulnCheck
Evidence observed: Apr 30, 2026

Primary CVSS

9.3/ 10Critical

nvd · CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS probability estimate

98.5%

High · next 30 days

Percentile: 99.9%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

CISA Known Exploited

This CVE appears in the CISA Known Exploited Vulnerabilities catalog.

Summary

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Sources

65

CVE-2026-41940Exploit
CVE-2026-41940
CVE-2026-41940Exploit
cPanel & WHM - Authentication Bypass via Session-File CRLF Injection
CVE-2026-41940Exploit
cPanel/WHM Authentication Bypass (Zero-Day Vulnerability)
cpsniper

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.

Exploit

cPanelSniper STABLE - CVE-2026-41940 optimized for 10M+ targets

CVE-2026-41940Exploit

CVE-2026-41940 — cPanel/WHM Auth Bypass By Dr.Anach, CRLF injection in `cpsrvd` Basic auth handler → unauthenticated WHM API access → RCE as root. All cPanel since v11.40 affected.

CVE-2026-41940Exploit

Redacted cPanel/WHM authentication bypass analysis and authorized checker

cpanelCVE-2026-41940Exploit

Proof-of-concept exploit for CVE-2026-41940, a critical cPanel & WHM authentication bypass via session-file CRLF injection, enabling automatic root login to WHM interface.

cPanel-WHM-CVE-2026-41940-auth-bypass-exploitExploit

Critical authentication bypass exploit for cPanel/WHM CVE-2026-41940. Leverages CRLF injection in cpsrvd daemon to gain root WHM access without credentials. Includes version detection, verbose logging, proxy support, JSON reporting, and post-exploitation account enumeration. For authorized security testing only.

CVE-2026-41940Exploit

cPanel/WHM Authentication Bypass (Zero-Day Vulnerability)

CVE-2026-41940Exploit

Exploit script for CVE-2026-41940, an authentication bypass in cPanel/WHM using CRLF injection to gain admin access and change root password, with multi-threaded scanning and Telegram notifications.

CVE-2026-41940Informational

Technical analysis and educational resource for CVE-2026-41940, covering root cause, scanner behavior, prevention, mitigation, IOC hunting, and VaPT methodology with MITRE mapping.

CVE-2026-41940_exploitExploit

Python exploit for CVE-2026-41940, a critical CRLF injection in cPanel/WHM cpsrvd that bypasses authentication and 2FA, granting root-level access via a 4-step HTTP attack chain.

POC_CVE-2026-41940Exploit

Proof-of-concept exploit for CVE-2026-41940 targeting cPanel, enabling account enumeration, command execution, and interactive shell access on vulnerable hosts.

cPanel-WHM-CVE-2026-41940-AuthBypassScanner

Scanner for cPanel & WHM authentication bypass (CVE-2026-41940) that detects vulnerable versions via CRLF injection and session manipulation, with multi-threading and proxy support.

CVE-2026-41940-Exploit-PoCExploit

Exploit PoC for CVE-2026-41940, a cPanel & WHM authentication bypass via CRLF injection. Includes mass scanning, post-exploitation actions, and an interactive shell for authorized testing.

CVE-2026-41940Exploit

Bulk scanner and mass exploitation tool for CVE-2026-41940 on cPanel/WHM, built for automated target validation and high-speed multi-threaded execution.

cPanelWHM-AuthBypassExploit

Go-based scanner and exploit tool for CVE-2026-41940, an authentication bypass in cPanel/WHM. Supports batch scanning, token leakage, and post-exploitation actions like RCE, password change, and API calls.

CVE-2026-41940Exploit

cPanel/WHM Authentication Bypass (Zero-Day Vulnerability)

CVE-2026-41940-cPanel-Auth-Bypass-ExploitExploit

Exploit for CVE-2026-41940, an authentication bypass in cPanel/WHM, allowing unauthenticated attackers to gain root access via session injection and JSON cache promotion.

CVE-2026-41940Exploit

Proof-of-concept exploit for CVE-2026-41940, an authentication bypass chain in WHM/cPanel. Multi-threaded scanner that changes root password on vulnerable targets. For authorized testing only.

CVE-2026-41940-analysisResearch

Technical analysis of the cPanel/WHM auth bypass

cve-2026-41940-cpanel_authbypass_reproductionExploit

CVE Reproduction: cve-2026-41940-cpanel_authbypass_reproduction

CVE-2026-41940Exploit

Proof-of-concept exploit for CVE-2026-41940, an unauthenticated authentication bypass in cPanel/WHM using CRLF injection to leak security tokens and reset the root password.

Automated-scanner-CVE-2026-41940Exploit

Automated scanner & post-exploitation toolkit for CVE-2026-41940 — cPanel & WHM root authentication bypass via session-file CRLF injection

CVE-2026-41940-cPanel-WHM-Verification-ToolDetection

Python verification script for CVE-2026-41940, an authentication bypass in cPanel & WHM, enabling authorized defensive validation and patching guidance.

CVE-2026-41940-PoC-ExploitExploit

🚀 CVE-2026-41940 cPanel/WHM Auth Bypass Exploit - Best Flow 💥 CRLF injection leads to auth bypass, session hijacking & account leak. ✅ Proxy, custom UA, keep-alive, retries, SSL verify, colored output, file save support. ⚡ Advanced PoC for pentesters.

CVE-2026-41940Detection

Generates detection artifacts to verify cPanel/WHM authentication bypass vulnerability (CVE-2026-41940) and tests targets for exposure.

CVE-2026-41940-AuthBypass-DetectorDetection

Detection tool for cPanel/WHM CVE-2026-41940 (CRLF injection auth bypass). Verify vulnerability on servers you own or have permission to test. For authorized security assessments only.

CVE-2026-41940Exploit

Concurrent Go-based detection and Python exploitation tool for CVE-2026-41940, enabling rapid vulnerability assessment and targeted exploitation.

cPanelSniperExploit

CVE-2026-41940 — cPanel & WHM Authentication Bypass via Session-File CRLF Injection

CVE-2026-41940-POCPoC

Proof-of-concept exploit for CVE-2026-41940, demonstrating authentication bypass in cPanel/WHM via CRLF injection and session poisoning to gain root-level access.

cPanelSniperExploit

CVE-2026-41940 — cPanel & WHM Authentication Bypass via Session-File CRLF Injection

cve-2026-41940-PoCExploit

Exploits CVE-2026-41940, a cPanel/WHM authentication bypass, to gain root WHM access and run post-exploitation commands, account listing, and interactive shell sessions.

cve-2026-41940-PoCPoC

Python PoC exploiting CVE-2026-41940, a cPanel & WHM authentication bypass enabling unauthenticated root-level WHM access, with scanning and post-exploitation shell commands.

CVE-2026-41940Exploit

cPanel/WHM CVE-2026-41940 - Mass Scanner & Exploiter

cpanel-pwnExploit

cPanel/WHM CVE-2026-41940 CRLF injection auth bypass exploit

cve-2026-41940-PoC-LinuxPoC

Proof-of-concept exploit for CVE-2026-41940, an authentication bypass in cPanel/WHM. Supports custom payloads and verbose logging, compatible with Linux and Termux for authorized security testing.

cpanelscannerScanner

Scans internet-exposed cPanel/WHM instances for CVE-2026-41940 authentication bypass, probing HTTPS on port 2087 and matching response markers to identify vulnerable hosts.

CPANEL-CVE-2026-41940Exploit

Proof-of-concept exploit for CVE-2026-41940, a critical cPanel/WHM authentication bypass via CRLF injection, enabling unauthenticated root access and interactive shell.

CVE-2026-41940---cPanel-WHM-checkDetection

This is the office check script provided by cPanel for all the users who are using cPanel

cve-2026-41940-pocPoC

Proof-of-concept exploit for CVE-2026-41940, demonstrating the vulnerability and its impact for security research and testing.

portscan-CVE-2026-41940Scanner

IP CIDRs (presumably as input, maybe command line or file) and checks ports 2083 and 2087 for openness

cpanel-cve-2026-41940-iocDetection

CVE-2026-41940 cPanel/WHM auth bypass IOC scanner — fixes false positives in upstream detection script, adds log cross-correlation

cPanel-WHM-AuthBypass-Session-CheckerPoC

Validates injected sessions from the CVE-2026-41940 cPanel/WHM authentication bypass exploit, testing endpoints to distinguish patched servers from fully compromised targets.

CVE-2026-41940-MASS-EXPLOITExploit

Mass exploit tool for CVE-2026-41940 supporting single and mass scanning to automate exploitation of vulnerable targets.

CVE-2026-41940Exploit

Automated exploit for CVE-2026-41940, an authentication bypass in cPanel/WHM, allowing unauthorized administrative access to vulnerable servers.

cPanel-CVE-2026-41940-ScannerExploit

Advanced cPanel & WHM Security Scanner for CVE-2026-41940. with mass Shodan discovery

CVE-2026-41940Exploit

Exploit for CVE-2026-41940 providing direct shell access via websocket and persistence through root API key injection.

2026-41940-pocExploit

CVE-2026-41940: detect and exploit cpanel vuln

cve-2026-41940-toolExploit

A comprehensive Python utility to **detect**, **scan in bulk**, and **exploit** the critical authentication bypass vulnerability (CVE-2026-41940) in cPanel & WHM and WP Squared.

whmxploit---CVE-2026-41940PoC

Exploit for CVE-2026-41940, targeting a specific vulnerability in WHMCS. Provides proof-of-concept code for security testing and research.

CVE-2026-41940-Exploit-PoCPoC

Proof-of-concept exploit for CVE-2026-41940, an authentication bypass in cPanel & WHM, enabling unauthenticated access to the control panel.

CVE-2026-41940-cpanel-0dayScanner

CVE-2026-41940 latest cPanel & WHM 0day - 70 million websites are possible to expose by Chirag Artani

CVE-2026-41940Scanner

A security research tool for detecting and analyzing cPanel/WHM services and their authentication behavior. Designed for authorized testing and educational purposes only.

CVE-2026-41940Exploit

Python exploit for CVE-2026-41940, a zero-day vulnerability, enabling penetration testers and researchers to validate exposure and assess impact.

CVE-2026-41940-nextPoC

Proof-of-concept exploit for CVE-2026-41940, demonstrating the vulnerability and providing exploitation code for security testing and research.

CVE-2026-41940-DetectionDetection

Detection signatures for CVE-2026-41940 and shemas for cPanel logs

cpanel-malware-cleaner-cve-2026Patch

Detects and removes malware, botnets, and webshells from cPanel servers, mitigating CVE-2026-41940 and related RCE vulnerabilities with one-command deployment.

watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.pyExploit

Detection artifact generator that verifies cPanel/WHM authentication bypass (CVE-2026-41940) and demonstrates RCE via CRLF injection, targeting WHM admin interface.

CVE-2026-41940-LinuxExploit

⚠️ DISCLAIMER: This tool is intended for authorized penetration testing and educational purposes only. Using this tool against systems without explicit written permission is illegal. The developers are not responsible for any misuse or damage caused.

poc-cpanel-cve-2026-41940Exploit

Multi-threaded security auditing tool that detects CVE-2026-41940, an authentication bypass in cPanel/WHM, using CRLF injection and dynamic port discovery for authorized penetration testing.

Security-CVE-2026-41940-cPanel-WHM-WP2PoC

Exploit or analysis tool targeting CVE-2026-41940 in cPanel/WHM, providing proof-of-concept or vulnerability assessment capabilities.

CVE-2026-41940-LinuxExploit

CVE-2026-41940Exploit

Private exploit

cPanel - CRLF InjectionExploit

nu11secur1ty · php · May 26, 2026