🛡️ CVE-2026-41940

The items that name it 5

• sakidekin/CVE-2026-41940-PoC
  repo2026-10-11

  Critical authentication bypass in cPanel and WHM (CVSS 10.0) that lets an unauthenticated attacker gain root-level WHM access by injecting CRLF sequences into server-side session files via the Authorization header.

• AI Agent Hacking Writeups
  repo2026-09-17It is written here as CVE-2026-41940 (cPanel WHM Auth Bypass, mentioned in HackerNotes Ep. 174).

  cPanel WHM Auth Bypass, mentioned in HackerNotes Ep. 174

• Socket: GitHub Actions Abuse Powers Distributed cPanel/WHM Exploitation Campaign
  writeup2026-07-23

  Authentication bypass vulnerability in cPanel and WHM, exploited by a Linux scanning payload deployed via abused GitHub Actions runners to harvest server credentials.

• CVE-2026-41940: cPanel & WHM Pre-Auth RCE — Two Write Paths, One Filter
  writeup2026-05-01

  cPanel & WHM pre-auth RCE via authentication bypass in the login flow; CRLF injection in session file's pass field promoted to top-level session keys during cache rewrite, allowing an unauthenticated attacker to obtain a root WHM session and ultimately root RCE via SSH key upload. CVSS 9.8. Patched

• CVE-2026-41940 (SessionScribe): cPanel/WHM Session Forgery Reverse-Engineered
  writeup2026-04-29

  Unauthenticated session forgery in cPanel/WHM; CRLF injection into the password field of a preauth session promotes attacker input into canonical session attributes, resulting in a logged-in root session and root-equivalent cpsess token. Disclosed 2026-04-28 by cPanel as KB 40073787579671; public Po