📖 Overview

cPanelCVE is a proof‑of‑concept exploit for CVE-2026-41940, a critical session‑file CRLF injection vulnerability in cPanel & WHM that allows complete root authentication bypass on WHM (Web Host Manager) port 2087.

Once the bypass is successful, the tool automatically opens your browser (Chrome or Firefox) and logs you directly into the WHM interface as root — no manual cookie setup, no password, no click‑throughs.

🧬 How It Works

The exploit runs in 4 stages:

After Stage 4, the tool either:

• Opens Chrome/Firefox instantly, injects the session cookie via DevTools, and lands on the WHM dashboard (fully automatic).
• Or prints ready‑to‑use JavaScript commands for manual login.

⚡ Quick Start

Prerequisites

• Python 3.8+ (stdlib only for exploit core)
• Selenium (for auto‑browser login):
  root@kitploit:~

  pip install selenium
  pip install -r requirements.txt
  

⚡ Usage

# Auto‑login with Chrome (default)
python cpanelcve.py -u https://target.com:2087 --selenium

# Auto‑login with Firefox
python cpanelcve.py -u https://target.com:2087 --selenium --engine firefox

# Print manual browser console commands
python cpanelcve.py -u https://target.com:2087 --browser

_{Made with ❤️ by @mahanOFp}