## https://sploitus.com/exploit?id=9A9A7755-3E15-5829-AC81-8AC9D66F3A4E
# CVE-2026-41940 โ cPanel & WHM Authentication Bypass
**CVSS v3.1: 9.8 (Critical)**
## Overview
CVE-2026-41940 is a critical authentication bypass vulnerability in cPanel & WHM that allows unauthenticated attackers to gain full administrative access to the control panel. The vulnerability was exploited in the wild within 24 hours of public disclosure, with ransomware being deployed against vulnerable hosts. It was discovered and publicly disclosed by watchTowr researchers.
## Technical Details
The login flow in cPanel/WHM improperly validates session tokens during the authentication handshake. By crafting a specific sequence of HTTP requests to the login endpoints, an attacker can manipulate the server into accepting a forged or skipped authentication step, effectively bypassing credential verification.
The bypass exploits a race condition / logic flaw in the `login.cgi` and `cpsess` token generation flow. The server does not properly verify that the session was established through a legitimate login โ it only checks for the presence of a correctly formatted session cookie, which can be predicted or forced.
## Affected Versions
- All cPanel & WHM versions **after 11.40** up to the latest prior to the security patch
- Confirmed on: 11.40โ11.98, 12.0โ12.6
## Reproduction Steps
1. Target a cPanel/WHM instance (port 2082 for cPanel, 2083 for WHM)
2. Send an initial request to `/login.cgi` to obtain the `cpsess` token prefix
3. Forge a session cookie using the leaked token seed
4. Access admin endpoints directly with the forged session
## Proof of Concept
```bash
python exploit.py --target 192.168.1.100 --port 2083 --ssl --cmd "id"
```
## Mitigation
- Immediately upgrade cPanel/WHM to the latest patched version
- Restrict access to cPanel/WHM ports (2082, 2083, 2095, 2096) via firewall
- Enable multi-factor authentication
- Monitor for unauthorized `cpsess` token usage in access logs
## References
- watchTowr disclosure: https://labs.watchtowr.com/
- CVE entry: https://vulners.com/cve/CVE-2026-41940
- cPanel security announcements: https://news.cpanel.com/category/security/