Skip to content

Back to the catalog

github.comrepo

sakidekin/CVE-2026-41940-PoC

This repository hosts a proof-of-concept for CVE-2026-41940, described as a CVSS 10.0 unauthenticated authentication bypass in cPanel and WHM caused by CRLF injection into server-side session files via the Authorization header. The accompanying Python tool (cve.py) can detect vulnerable cPanel/WHM instances, retrieve system and account information, and perform post-exploitation actions such as running OS commands, changing the root password, and opening an interactive WHM shell. It also supports bulk scanning workflows piped from subfinder, httpx, and Shodan.

TL;DR Proof-of-concept tool exploiting an unauthenticated CRLF-injection auth bypass in cPanel/WHM (CVE-2026-41940) for root-level access.
Open original ↗
Document

What it is

A Python tool (cve.py) for CVE-2026-41940, which the README describes as an unauthenticated authentication bypass in cPanel and WHM with a CVSS score of 10.0. The README says it gives root-level WHM access with no credentials. It is labelled for education and bug bounty use only.

How it works

The README describes the flaw only in general terms. The login interface starts a session before credentials are fully validated. Crafted input, which the README says is CRLF sequences in the Authorization header, then changes how session data is stored or read on the server. The page gives no exact payload or root cause beyond this.

Preconditions / Affected

The examples target the cPanel and WHM service ports 2083, 2085, 2086 and 2087. Any host exposing these to the internet is the relevant population. The page names no affected or fixed versions and says nothing about whether a vendor patch exists.

What to do

The page has no defensive guidance: no patch, no mitigation, no detection rule and no indicators. Based on what it does show, a defender could:

  • Check which hosts expose ports 2083, 2085, 2086 and 2087 to the internet.
  • Review WHM and cPanel session files and access logs for unexpected sessions, or for Authorization headers containing line-break characters.
  • Check for root password changes and for unexpected accounts. The tool's passwd and adduser actions create exactly these traces.
  • Look for commands run through WHM. The tool's cmd, exec and shell actions run OS commands this way.

Treat the vendor advisory, not this page, as the source for the fixed version.

Caveats

  • Beyond the summary, the tool also has an adduser action (creating a cPanel account) and a --force flag that skips the cPanel detection check.
  • The README's clone instructions point to github.com/yasouxken/CVE-2026-41940-PoC, not the sakidekin repository this entry links. That mismatch means the code's provenance is unclear, so it should not be run outside an isolated lab.
  • Nothing on the page confirms the exploit works against any specific version.

Organisations named here

  • CRLF injection

CVEs named here

  • CVE-2026-41940

Technologies named here

  • CVE-2026-41940-PoC
  • cPanel & WHM
  • subfinder
  • httpx
  • Shodan
  • Python

Techniques named here

  • Authentication bypass via CRLF injection into session files
  • Mass scanning and exploitation pipeline
  • Authentication bypass

Related in Offensive Security