imbas007/POC_CVE-2026-41940

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that performs a 4-stage authentication bypass exploit against cPanel & WHM (CVE-2026-41940) to gain root access, then offers post-exploitation actions including command execution, password change, and an interactive shell.

Backdoor review

No backdoor observed in reviewed code

The PoC implements a documented 4-stage authentication bypass exploit for CVE-2026-41940 against cPanel/WHM. All code is readable Python with no obfuscation. The post-exploit actions (list accounts, change password, execute commands, create user, read files) are consistent with the stated exploit goal of demonstrating unauthorized root access. No concealed payloads, persistence mechanisms, or unrelated remote access features were observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwarecPanelWHM
Attack typesauthentication bypasscommand injectionprivilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively performs a multi-stage attack chain (CRLF injection, session poisoning, token propagation) to bypass authentication and gain root WHM access, then provides post-exploitation capabilities including command execution and an interactive shell. This is exploitation, not mere detection.

POC_CVE-2026-41940.py:4-5POC_CVE-2026-41940.py:11-16POC_CVE-2026-41940.py:922-1033

Requirements

  • Target must be a vulnerable cPanel/WHM instance (versions before patches listed in CVE-2026-41940).POC_CVE-2026-41940.py:24-26
  • Network access to the target's WHM port (default 2087).POC_CVE-2026-41940.py:30

Observed behavior

  • Discovers canonical hostname via /openid_connect/cpanelid redirect.POC_CVE-2026-41940.py:250-263
  • Mints a preauth session by POSTing wrong credentials to /login/?login_only=1.POC_CVE-2026-41940.py:268-305
  • Injects CRLF characters into the session file via a crafted Authorization: Basic header.POC_CVE-2026-41940.py:310-336
  • Triggers session cache propagation by requesting /scripts2/listaccts.POC_CVE-2026-41940.py:341-367
  • Verifies root access by requesting /json-api/version and checking for a 200 response with version data.POC_CVE-2026-41940.py:372-399
  • Offers post-exploit actions: list accounts, change root password, execute OS commands, create users, read files, and an interactive WHM shell.POC_CVE-2026-41940.py:639-896
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Chain
4-stage CRLF injection authentication bypassThe script performs a documented exploit chain: canonical host discovery, preauth session minting, CRLF injection via Authorization header, token denial gadget propagation, and root access verification.POC_CVE-2026-41940.py:11-16
Post Exploit Actions
list accounts, change root password, execute OS commands, create user, read files, interactive shellPost-exploit actions are consistent with demonstrating the impact of the authentication bypass vulnerability.POC_CVE-2026-41940.py:18-22
Payload
Base64-encoded CRLF injection payloadThe payload injects session fields (hasroot=1, tfa_verified=1) to bypass authentication. It is clearly documented and directly related to the CVE.POC_CVE-2026-41940.py:91-101
Review boundaries

What the analysis did not establish

  • Evidence is limited to the supplied text files; no runtime behavior or network traffic was observed.
  • The artifact's README.md references an external repository (ynsmroztas/cPanelSniper) not included in the evidence.
  • Only the two text files (POC_CVE-2026-41940.py and README.md) were reviewed; no other files exist in the repository.
  • The review does not assess whether the exploit actually works or is safe to execute against a target.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1