razureink/cve-2026-41940-cpanel_authbypass_reproductionCVE Reproduction: cve-2026-41940-cpanel_authbypass_reproduction
CVSS v3.1: 9.8 (Critical)
CVE-2026-41940 is a critical authentication bypass vulnerability in cPanel & WHM that allows unauthenticated attackers to gain full administrative access to the control panel. The vulnerability was exploited in the wild within 24 hours of public disclosure, with ransomware being deployed against vulnerable hosts. It was discovered and publicly disclosed by watchTowr researchers.
The login flow in cPanel/WHM improperly validates session tokens during the authentication handshake. By crafting a specific sequence of HTTP requests to the login endpoints, an attacker can manipulate the server into accepting a forged or skipped authentication step, effectively bypassing credential verification.
The bypass exploits a race condition / logic flaw in the login.cgi and cpsess token generation flow. The server does not properly verify that the session was established through a legitimate login — it only checks for the presence of a correctly formatted session cookie, which can be predicted or forced.
/login.cgi to obtain the cpsess token prefixpython exploit.py --target 192.168.1.100 --port 2083 --ssl --cmd "id"
cpsess token usage in access logs