# CVE-2026-41940: The cPanel and WHM Authentication Bypass Explained and How to Patch It

Source: https://www.egnworks.com/blog/cve-2026-41940-the-cpanel-and-whm-authentication-bypass-explained-and-how-to-patch-it  
Author: Jacob Strix  
Published: 2026-05-03  
Updated: 2026-05-03  
Category: Security  
Tags: CVE-2026-41940, cPanel, Authentication

> Critical cPanel and WHM authentication bypass (CVE-2026-41940, CVSS 9.8) exploited since February 2026. Full root-cause analysis, exploitation chain, patched versions, and step-by-step remediation.

---

On April 28, 2026, WebPros International, the company behind cPanel and WHM, published an emergency security advisory for **CVE-2026-41940**, a critical authentication bypass affecting effectively every supported version of the platform. The flaw carries a **CVSS v3.1 score of 9.8** and has been added to the CISA Known Exploited Vulnerabilities catalog. Telemetry from the Shadowserver Foundation observed roughly **44,000 unique IP addresses** scanning, brute forcing, or running exploit payloads against honeypot sensors within 48 hours of disclosure.

This post walks through what the vulnerability actually is, how the exploit chain works, which versions are affected, and exactly what you need to do to patch and verify a clean recovery.

## Executive Summary

CVE-2026-41940 is an unauthenticated remote authentication bypass in cPanel and WHM caused by a Carriage Return / Line Feed (CRLF) injection in the session writing path, combined with a cookie-driven encryption skip and a session cache promotion quirk. A successful exploit yields full root-equivalent access to WHM, every cPanel account on the host, all hosted databases, and every email mailbox.

**Disclosure date:** April 28, 2026

**CVSS v3.1:** 9.8 (Critical)

**Vector:** AV:N / AC:L / PR:N / UI:N / S:U / C:H / I:H / A:H

**Affected:** All supported cPanel and WHM versions after 11.40, plus WP Squared

**In-the-wild exploitation** since at least February 23, 2026

**Internet-exposed instances:** approximately 1.5 million (Shodan)

**Status:** CISA KEV listed; public PoC available

## Root Cause

The bug lives in three Perl modules that handle session persistence: `Cpanel/Session.pm` (saver), `Cpanel/Session/Load.pm` (loader), and `Cpanel/Session/Encoder.pm` (encoding primitives).

The saver function `saveSession` fails to sanitize raw CRLF characters out of the password field before serializing the session to disk. The encryption layer that normally protects session writes is also bypassed when the per-session secret, passed as the `ob` parameter inside the `whostmgrsession` cookie, is absent. Together these two flaws turn the on-disk session file into a writable, attacker-controlled key/value store.

## The Exploitation Chain

The attack proceeds in four distinct stages.

### Stage 1: Preauth Session Creation

The attacker initiates a deliberately failed login. cPanel still issues a valid preauth session ID with minimal privileges and writes a session record to `/var/cpanel/sessions/raw/session_id`.

### Stage 2: CRLF Injection via Basic Auth

Using HTTP Basic authentication and a modified `whostmgrsession` cookie with the hex obfuscation suffix stripped, the attacker sends a password value containing literal newline sequences. The injected payload includes forged session attributes such as `hasroot=1`, `successful_internal_auth_with_timestamp=9999999999`, and `user=root`. The `set_pass()` routine inside `cpsrvd` only strips null bytes, leaving CRLF characters intact when the value is passed to `saveSession`.

### Stage 3: Cache Promotion

The attacker issues a request that lacks a valid security token, deliberately routing execution into `do_token_denied`, which calls `Cpanel::Session::Modify::new()` and `save()`. Those functions read the raw text session file and serialize the parsed result into the JSON cache, promoting every attacker-injected attribute to the top level of the trusted session object.

### Stage 4: Authentication Bypass

On the next authenticated call, `docheckpass_whostmgrd` finds `successful_internal_auth_with_timestamp` present and skips the password check against `/etc/shadow` entirely. The attacker is now root inside WHM.

## Affected and Patched Versions

WebPros shipped fixed builds across every supported tier. Match your current tier and update to the corresponding patched build.

Tier 11.86 (EL6/CL6): patched at **11.86.0.41**

Tier 11.110: patched at **11.110.0.97**

Tier 11.118: patched at **11.118.0.63**

Tier 11.124: patched at **11.124.0.35**

Tier 11.126: patched at **11.126.0.54**

Tier 11.130: patched at **11.130.0.19**

Tier 11.132: patched at **11.132.0.29**

Tier 11.134: patched at **11.134.0.20**

Tier 11.136: patched at **11.136.0.5**

WP Squared: patched at **136.1.7**

Tiers 11.112, 11.114, 11.116, 11.120, 11.122, and 11.128 have no dedicated patch and must migrate to a patched tier or block external access until they can.

## How to Patch

The standard remediation path is an in-place upgrade through cPanel's update pipeline.

### Step 1: Confirm your current version

```bash
/usr/local/cpanel/cpanel -V
```

### Step 2: Force an immediate upgrade

```bash
/scripts/upcp --force
```

A force upgrade typically takes ten to thirty minutes on a mid-sized server and will restart `cpsrvd`, `cpdavd`, `exim`, `dovecot`, and the database engine.

### Step 3: Hard restart cpsrvd

```bash
/scripts/restartsrv_cpsrvd --hard
```

### Step 4: Verify the patched build

```bash
/usr/local/cpanel/cpanel -V
```

The reported build must match the patched version for your tier in the list above.

### Special Case: CentOS 6 and CloudLinux 6 on v110.0.50

```bash
whmapi1 set_tier tier=11.110.0.103
/scripts/upcp --force
```

## Emergency Mitigation if You Cannot Patch Immediately

If the upgrade window is delayed, restrict network reachability to the cPanel and WHM service ports.

**CSF approach:** Remove ports 2082, 2083, 2086, 2087, 2095, 2096 from `TCP_IN` in `/etc/csf/csf.conf`, then reload:

```bash
csf -r
```

**Service-stop approach:** Disable the vulnerable daemons entirely:

```bash
whmapi1 configureservice service=cpsrvd enabled=0 monitored=0
whmapi1 configureservice service=cpdavd enabled=0 monitored=0
/scripts/restartsrv_cpsrvd --stop
/scripts/restartsrv_cpdavd --stop
```

These are stop-gap measures. Patch as soon as the maintenance window allows.

## Indicators of Compromise

Patching alone does not undo a prior breach. Because exploitation has been observed since at least February 23, 2026, every host should be audited.

### Forged Session Fingerprint

Look inside `/var/cpanel/sessions/raw/` for files containing these hallmark forged attributes:

```ini
pass=x
user=root
hasroot=1
tfa_verified=1
successful_internal_auth_with_timestamp=9999999999
origin_as_string=address=127.0.0.1,app=whostmgrd,method=badpass
token_denied=1
```

A legitimate preauth session never contains `pass=`, `hasroot=1`, or `successful_internal_auth_with_timestamp`.

### Login Log Review

```bash
grep 'method=badpass' /usr/local/cpanel/logs/login_log
```

### SessionScribe Scanners by R-fx Networks

A non-destructive remote probe and an on-host IoC scanner are publicly available. Exit codes: **0** = patched and clean, **1** = vulnerable, **2** = inconclusive, **4** = compromised.

```bash
curl -fsSLO https://sh.rfxn.com/sessionscribe-remote-probe.sh
bash sessionscribe-remote-probe.sh --target YOUR_SERVER_IP --quiet --no-color

curl -fsSLO https://sh.rfxn.com/sessionscribe-ioc-scan.sh
bash sessionscribe-ioc-scan.sh --jsonl --quiet
```

## Post-Patch Hardening

A patched but previously exposed host should be treated as potentially compromised. Recommended actions:

Rotate every WHM root, reseller, and administrator password.

Revoke and regenerate every WHM API token.

Force a global session reset to clear all existing sessions:

```bash
rm -f /var/cpanel/sessions/raw/* /var/cpanel/sessions/cache/*
```

Diff `/etc/passwd`, cron jobs, and `authorized_keys` against your last known-good backup.

Enable proxy subdomains so administrative access flows through port 443 rather than 2083:

```bash
whmapi1 set_tweaksetting key=proxysubdomains value=1
/scripts/proxydomains add
```

Deploy SessionScribe-aware ModSecurity rules from R-fx Networks and reload Apache.

Restrict direct exposure of cpsrvd ports to a management subnet only.

## Why This Matters

The combination of an authentication bypass requiring no user interaction, no privilege requirement, and approximately **1.5 million internet-exposed instances** makes CVE-2026-41940 one of the highest-impact hosting-layer vulnerabilities of the year. A single compromised cPanel host typically holds dozens to hundreds of customer websites, every associated database, and every mailbox, making it a near-perfect supply-chain pivot point.

Major hosting providers including **Namecheap, KnownHost, HostPapa, and InMotion** preemptively blocked TCP/2083 and TCP/2087 ahead of patching, accepting customer-facing downtime as the lesser cost. Independent administrators should act with the same urgency.

## Timeline

**February 23, 2026** - Earliest observed in-the-wild exploitation

**Mid-April 2026** - Vulnerability privately disclosed to cPanel

**April 28, 2026** - Public advisory and patches released

**April 30, 2026** - watchTowr Labs publishes PoC; CISA adds CVE-2026-41940 to KEV; Shadowserver records 44,000 unique scanning IPs

## Conclusion

If you operate any cPanel or WHM host, the action items are non-negotiable: **patch to the build matching your tier, rotate credentials, scan for indicators of compromise, and harden network exposure of the administrative ports.** The exploitation window opened more than two months before disclosure, so a clean version string alone is not proof of a clean host.

## References

[WebPros / cPanel official security advisory (April 28, 2026)](https://docs.cpanel.net/security-advisories/)

[watchTowr Labs - technical deep-dive and proof-of-concept](https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/)

[R-fx Networks - SessionScribe reverse engineering and detection tooling](https://rfxn.com/research/cpanel-sessionscribe-cve-2026-41940)

[Rapid7 Emergent Threat Report - CVE-2026-41940](https://www.rapid7.com/blog/post/etr-cve-2026-41940-cpanel-whm-authentication-bypass/)

[NVD - CVE-2026-41940 detail](https://nvd.nist.gov/vuln/detail/CVE-2026-41940)

[CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

[Help Net Security - cPanel zero-day exploited before patch](https://www.helpnetsecurity.com/2026/04/30/cpanel-zero-day-vulnerability-cve-2026-41940-exploited/)

[BleepingComputer - cPanel WHM emergency update](https://www.bleepingcomputer.com/news/security/cpanel-whm-emergency-update-fixes-critical-auth-bypass-bug/)

[The Hacker News - Critical cPanel Authentication Vulnerability](https://thehackernews.com/2026/04/critical-cpanel-authentication.html)

*Authored by Jacob Strix, CEO and Security Researcher at Egnworks.*