CVE-2026-41940 — WHM/cPanel Authentication Bypass Research Tool

This repository contains a Proof-of-Concept (PoC) script based on the authentication bypass chain for cPanel/WHM (via the whostmgrsession cookie and HTTP headers). After a successful compromise, the script changes the root password and writes the result to a file.

Legal disclaimer

Use this software only on systems you have explicit permission to test (your own lab environment, contracted pentests, vendor-approved security testing). Unauthorized access is a crime in most countries. This README is intended solely for security research and defense awareness; the authors are not responsible for misuse.

Features

• Multi-target scanning with a target list (similar to targets.txt)
• Default WHM TLS port 2087; the scheme is normalized to https
• Stages: pre-session (/login), /cpsess leak via CRLF injection, do_token_denied trigger, verification via /json-api/version
• Targets with confirmed successful password changes are appended to res.txt
• Optional Host header override (reverse proxy / virtual host scenarios)
• Multi-threading (ThreadPoolExecutor)

Requirements

• Python 2.7 (#!/usr/bin/env python2.7 — the script uses Python 2 syntax and urllib / urlparse)
• Dependencies: requirements.txt

pip install -r requirements.txt

Note: On Python 2, the futures package is required for concurrent.futures (listed in the file). Porting the script to Python 3 requires adapting differences such as urllib, urlparse, print, unicode/str, and similar; this has not been done in this repository.

Usage

python CVE-2026-41940.py <target_list_file> [--hostname CANONICAL_HOST] [--threads N] [--timeout SECONDS]

Output:

• Stage-by-stage log on the console
• Only targets whose password change is considered successful are written to res.txt in URL and session info format

Defense and hardening recommendations (summary)

• Keep WHM/cPanel and related components up to date; monitor security bulletins.
• Use source IP restrictions or VPN access for 2087 (and unnecessary management ports).
• Consider a WAF and log correlation for abnormal Authorization / cookie combinations and unexpected redirects.

File structure

├── CVE-2026-41940.py   # Main script
├── requirements.txt    # pip dependencies
└── README.md

Ethical use

Changing passwords on production systems after compromise carries the risk of data loss and service disruption. Test in non-production, isolated lab environments and with written permission; share your findings through responsible disclosure (coordinated disclosure) processes.