CVE-2026-41940-POC

CVE-2026-41940 – cPanel/WHM Authentication Bypass PoC

This repository contains a proof-of-concept (PoC) exploit for CVE-2026-41940, demonstrating a multi-step authentication bypass in cPanel/WHM via CRLF injection and session poisoning.

Disclaimer: This code is for educational and authorized security testing only. Do NOT use against systems you do not own or have explicit permission to test.

Overview

This PoC replicates a real-world exploitation chain based on techniques observed by Hadrian and watchTowr.

The vulnerability allows an attacker to:

Inject arbitrary session data via CRLF injection Poison server-side session files Bypass authentication Gain root-level access to WHM APIs How It Works

The exploit follows a 4-step process:

1. Obtain Pre-auth Session Sends a login request with invalid credentials Extracts a valid session cookie (whostmgrsession / cpsession)
2. Inject CRLF Payload Sends a crafted Authorization header (base64 encoded) Injects malicious key-value pairs into the session file

Injected payload includes:

user=root hasroot=1 tfa_verified=1 cp_security_token=/cpsessXXXXXXXXXX 3. Trigger Session Regeneration Forces cPanel to rewrite the session file May preserve injected malicious values 4. Verify Authentication Bypass Calls WHM API endpoint: /json-api/version?api.version=1

If successful:

Returns HTTP 200 Confirms root-level access Usage Requirements Python 3.x requests library

Install dependency:

pip install requests Run the Exploit python3 exploit.py --host Optional Flags: --ssl Use HTTPS --port Specify custom port --verbose Enable debug output Example python3 exploit.py --host example.com --ssl --port 2087 --verbose Expected Output

Successful exploitation:

[+] SUCCESS! Authenticated as root via CVE-2026-41940. [+] Cookie: whostmgrsession=... [+] Admin URL: https://target:2087/cpsess.../json-api/version?api.version=1

Reliability Notes The exploit retries up to 5 times Due to: Randomized hash iteration in Perl Possible overwriting of injected session values

Mitigation

If you are a system administrator:

Apply latest cPanel/WHM patches immediately Block CRLF injection vectors Use WAF rules to sanitize headers Monitor abnormal session file writes

Technical Details

The vulnerability lies in:

Improper handling of session data Lack of sanitization in header parsing Unsafe session file serialization

The exploit abuses:

Authorization header injection Base64-encoded CRLF payload Session regeneration logic Legal Notice

This PoC is provided as-is for:

Security research Defensive testing Educational purposes

Unauthorized use may violate laws and regulations.