CVE-2026-41940

GitHub PoCs · by trust, then stars74

1. ynsmroztas/cPanelSniper ↗Trust ok 100

   CVE-2026-41940 — cPanel & WHM Authentication Bypass via Session-File CRLF Injection

   ★ 508 · created 2026-05-01

2. sakidekin/CVE-2026-41940-PoC ↗Trust ok 100

   cPanel & WHM Authentication Bypass via CVE-2026-41940 explotation

   ★ 213 · created 2026-10-11

3. assetnote/cpanel2shell-scanner ↗Trust ok 100

   High fidelity scanner for CVE-2026-41940 (cPanel & WHM authentication bypass)

   ★ 92 · created 2026-04-30

4. XsanFlip/poc-cpanel-cve-2026-41940 ↗Trust ok 100

   ★ 63 · created 2026-05-01

5. adriyansyah-mf/cve-2026-41940-poc ↗Trust ok 100

   ★ 28 · created 2026-04-30

6. ZeroDayEvil/CVE-2026-41940-PoC ↗Trust ok 100

   ★ 28 · created 2026-09-28

7. Sachinart/CVE-2026-41940-cpanel-0day ↗Trust ok 100

   CVE-2026-41940 latest cPanel & WHM 0day - 70 million websites are possible to expose by Chirag Artani

   ★ 26 · created 2026-04-29

8. bughunt4me/cpanelCVE-2026-41940 ↗Trust ok 100

   CVE-2026-41940 Auto Root Login

   ★ 13 · created 2026-05-06

9. ilmndwntr/CVE-2026-41940-MASS-EXPLOIT ↗Trust ok 100

   CVE-2026-41940 SUPPORT SINGLE & MASS SCAN EXPLOIT

   ★ 13 · created 2026-04-30

10. rfxn/cpanel-sessionscribe ↗Trust ok 100

    Detection, mitigation, and reverse-engineering tooling for CVE-2026-41940 (SessionScribe): the cPanel/WHM unauthenticated session-forgery vulnerability disclosed 2026-04-28. Defense-in-depth active mitigation shim, ModSec rule pack, remote probe, on-host IOC scanner, and per-tier RE snapshot collector. GPL v2.

    ★ 13 · created 2026-04-30

11. realawaisakbar/CVE-2026-41940-Exploit-PoC ↗Trust ok 100

    This repository contains a Proof-of-Concept (PoC) exploit for CVE-2026-41940, a critical authentication bypass vulnerability in cPanel & WHM. The vulnerability allows unauthenticated remote attackers to gain unauthorized access to the control panel by abusing flaws in the login flow.

    ★ 12 · created 2026-04-30

12. Kagantua/cPanelWHM-AuthBypass ↗Trust ok 100

    CVE-2026-41940

    ★ 10 · created 2026-04-30

13. tc4dy/CVE-2026-41940-PoC-Exploit ↗Trust ok 100

    CVE-2026-41940 cPanel/WHM Auth Bypass Exploit - Best Flow - CRLF injection leads to auth bypass, session hijacking & account leak. Proxy, custom UA, keep-alive, retries, SSL verify, colored output, file save support. Advanced PoC for pentesters. Only Ethical & Safety Uses.

    ★ 10 · created 2026-05-12

14. 0xYuR1/CVE-2026-41940 ↗Trust ok 100

    cPanel/WHM Authentication Bypass (Zero-Day Vulnerability)

    ★ 9 · created 2026-05-01

15. murrez/CVE-2026-41940 ↗Trust ok 100

    PoC for CVE-2026-41940: WHM/cPanel authentication bypass chain (Python 2.7). For authorized security research and testing only.

    ★ 8 · created 2026-05-06

16. debugactiveprocess/cPanel-WHM-AuthBypass-Session-Checker ↗Trust ok 100

    Post-Exploitation Session Validation Tool for CVE-2026-41940

    ★ 6 · created 2026-04-29

17. habibkaratas/sorry-ransomware-analysis ↗Trust ok 100

    Sorry ransomware (.sorry) IOCs, YARA rules and forensic analysis - CVE-2026-41940 cPanel campaign

    ★ 6 · created 2026-05-04

18. senyx122/CVE-2026-41940 ↗Trust ok 100

    A security research tool for detecting and analyzing cPanel/WHM services and their authentication behavior. Designed for authorized testing and educational purposes only.

    ★ 6 · created 2026-05-01

19. Jenderal92/CVE-2026-41940 ↗Trust ok 100

    Bulk scanner and mass exploitation tool for CVE-2026-41940 on cPanel/WHM, built for automated target validation and high-speed multi-threaded execution.

    ★ 4 · created 2026-05-01

20. shahidmallaofficial/cpanel-cve-2026-41940-fix ↗Trust ok 100

    ★ 4 · created 2026-04-30

21. mahfuzreham/cpanel-cve-2026-41940 ↗Trust ok 100

    cPanel CVE-2026-41940 nuclear.x86 Security Audit & Cleanup Script

    ★ 3 · created 2026-05-01

22. NULL200OK/cve-2026-41940-tool ↗Trust ok 100

    A comprehensive Python utility to **detect**, **scan in bulk**, and **exploit** the critical authentication bypass vulnerability (CVE-2026-41940) in cPanel & WHM and WP Squared.

    ★ 3 · created 2026-05-01

23. 44pie/cpsniper ↗Trust ok 100

    cPanelSniper STABLE - CVE-2026-41940 optimized for 10M+ targets

    ★ 2 · created 2026-05-10

24. Andrei-Dr/cpanel-cve-2026-41940-ioc ↗Trust ok 100

    CVE-2026-41940 cPanel/WHM auth bypass IOC scanner — fixes false positives in upstream detection script, adds log cross-correlation

    ★ 2 · created 2026-04-30

25. CerberusMrXi/cPanel-WHM-CVE-2026-41940-auth-bypass-exploit ↗Trust ok 100

    Critical authentication bypass exploit for cPanel/WHM CVE-2026-41940. Leverages CRLF injection in cpsrvd daemon to gain root WHM access without credentials. Includes version detection, verbose logging, proxy support, JSON reporting, and post-exploitation account enumeration. For authorized security testing only.

    ★ 2 · created 2026-07-26

26. Ishanoshada/CVE-2026-41940-Exploit-PoC ↗Trust ok 100

    CVE-2026-41940 Exploit PoC – cPanel & WHM Authentication Bypass via CRLF Injection

    ★ 2 · created 2026-05-02

27. merdw/cPanel-CVE-2026-41940-Scanner ↗Trust ok 100

    Advanced cPanel & WHM Security Scanner for CVE-2026-41940. with mass Shodan discovery

    ★ 2 · created 2026-05-01

28. willygailo/CVE-2026-41940-Linux ↗Trust ok 100

    ⚠️ DISCLAIMER: This tool is intended for authorized penetration testing and educational purposes only. Using this tool against systems without explicit written permission is illegal. The developers are not responsible for any misuse or damage caused.

    ★ 2 · created 2026-05-27

29. 0xabdoulaye/CPANEL-CVE-2026-41940 ↗Trust ok 100

    ★ 1 · created 2026-04-30

30. 0xBlackash/CVE-2026-41940 ↗Trust ok 100

    CVE-2026-41940

    ★ 1 · created 2026-05-01

31. 0xgh057r3c0n/CVE-2026-41940 ↗Trust ok 100

    cPanel & WHM - Authentication Bypass via Session-File CRLF Injection

    ★ 1 · created 2026-09-05

32. AmirrezaMarzban/portscan-CVE-2026-41940 ↗Trust ok 100

    IP CIDRs (presumably as input, maybe command line or file) and checks ports 2083 and 2087 for openness

    ★ 1 · created 2026-05-01

33. AnotherSec/CVE-2026-41940 ↗Trust ok 100

    CVE-2026-41940

    ★ 1 · created 2026-07-24

34. george1-adel/CVE-2026-41940_exploit ↗Trust ok 100

    ★ 1 · created 2026-05-01

35. kmaruthisrikar/CVE-2026-41940-cPanel-Auth-Bypass-Exploit ↗Trust ok 100

    ★ 1 · created 2026-05-01

36. linko-iheb/cve-2026-41940-scanner ↗Trust ok 100

    ★ 1 · created 2026-05-02

37. MrOplus/CVE-2026-41940 ↗Trust ok 100

    CVE-2026-41940 Direct Shell Acess

    ★ 1 · created 2026-05-02

38. nickpaulsec/2026-41940-poc ↗Trust ok 100

    CVE-2026-41940: detect and exploit cpanel vuln

    ★ 1 · created 2026-05-04

39. razureink/cve-2026-41940-cpanel_authbypass_reproduction ↗Trust ok 100

    CVE Reproduction: cve-2026-41940-cpanel_authbypass_reproduction

    ★ 1 · created 2026-07-23

40. sardine-web/Automated-scanner-CVE-2026-41940 ↗Trust ok 100

    Automated scanner & post-exploitation toolkit for CVE-2026-41940 — cPanel & WHM root authentication bypass via session-file CRLF injection

    ★ 1 · created 2026-05-24

41. thekawix/CVE-2026-41940 ↗Trust ok 100

    cve-2026-41940 cPanel/WHM Authentication Bypass - Detection Artifact Generator

    ★ 1 · created 2026-05-07

42. Unfold-Security/CVE-2026-41940-Detection ↗Trust ok 100

    Detection signatures for CVE-2026-41940 and shemas for cPanel logs

    ★ 1 · created 2026-05-05

43. unteikyou/CVE-2026-41940-AuthBypass-Detector ↗Trust ok 100

    Detection tool for cPanel/WHM CVE-2026-41940 (CRLF injection auth bypass). Verify vulnerability on servers you own or have permission to test. For authorized security assessments only.

    ★ 1 · created 2026-05-01

44. zedxod/CVE-2026-41940-POC ↗Trust ok 100

    ★ 1 · created 2026-04-30

45. 0dev1337/cpanelscanner ↗Trust ok 100

    Cpanel Scanner For CVE-2026-41940

    ★ 0 · created 2026-05-01

46. 3tternp/CVE-2026-41940---cPanel-WHM-check ↗Trust ok 100

    This is the office check script provided by cPanel for all the users who are using cPanel

    ★ 0 · created 2026-05-02

47. acuciureanu/cpanel2shell-honeypot ↗Trust ok 100

    A Rust honeypot that simulates a vulnerable cPanel/WHM instance for CVE-2026-41940

    ★ 0 · created 2026-05-08

48. anach-ai/CVE-2026-41940 ↗Trust ok 100

    CVE-2026-41940 — cPanel/WHM Auth Bypass By Dr.Anach, CRLF injection in `cpsrvd` Basic auth handler → unauthenticated WHM API access → RCE as root. All cPanel since v11.40 affected.

    ★ 0 · created 2026-05-11

49. asdasddqwdq29-a11y/CVE-2026-41940 ↗Trust ok 100

    Redacted cPanel/WHM authentication bypass analysis and authorized checker

    ★ 0 · created 2026-06-06

50. branixsolutions/Security-CVE-2026-41940-cPanel-WHM-WP2 ↗Trust ok 100

    ★ 0 · created 2026-05-08

51. dann3xplo1t/Cpanel ↗Trust ok 100

    CVE-2026-41940 cPanel & WHM Auth Bypass

    ★ 0 · created 2026-07-23

52. dennisec/CVE-2026-41940 ↗Trust ok 100

    CVE-2026-41940

    ★ 0 · created 2026-05-02

53. devtint/CVE-2026-41940 ↗Trust ok 100

    https://devtint.github.io/CVE-2026-41940

    ★ 0 · created 2026-05-01

54. hitechcloud-vietnam/cve-2026-41940-PoC ↗Trust ok 100

    A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0), allowing unauthenticated attackers to gain root-level WHM access by injecting CRLF sequences into server-side session files via the Authorization header — no credentials required.

    ★ 0 · created 2026-09-26

55. imbas007/POC_CVE-2026-41940 ↗Trust ok 100

    ★ 0 · created 2026-05-03

56. iSee857/cPanel-WHM-CVE-2026-41940-AuthBypass ↗Trust ok 100

    cPanel-WHM-CVE-2026-41940-AuthBypass

    ★ 0 · created 2026-05-04

57. itsismarcos/CVE-2026-41940 ↗Trust ok 100

    Exploit CVE-2026-41940 auto exploit

    ★ 0 · created 2026-05-04

58. keithbennedict/CVE-2026-41940-Linux ↗Trust ok 100

    ★ 0 · created 2026-08-11

59. limo57640-crypto/cpanel-cve-41940-detector ↗Trust ok 100

    Read-only cPanel CVE-2026-41940 IOC detector for .sorry ransomware, Mr_Rot13 Filemanager backdoors, C2 callbacks, cron, SSH, and logs.

    ★ 0 · created 2026-05-16

60. MrAriaNet/cPanel-Fix ↗Trust ok 100

    One security-remediation.sh for CVE-2026-41940 (cPanel), CVE-2026-31431 (kernel "Copy Fail"), CSF, optional domain/proxy cleanup, and optional operator hardening.

    ★ 0 · created 2026-05-01

61. ngksiva/cpanel-forensics ↗Trust ok 100

    Форензика после CVE-2026-41940 (cPanel/WHM) — bash-скрипт и чек-лист

    ★ 0 · created 2026-05-10

62. oguz-kagan-akar/CVE-2026-41940-analysis ↗Trust ok 100

    Technical analysis of the cPanel/WHM auth bypass

    ★ 0 · created 2026-07-18

63. OhmGun/whmxploit---CVE-2026-41940 ↗Trust ok 100

    CVE-2026-41940

    ★ 0 · created 2026-05-06

64. Richflexpix/cpanel-pwn ↗Trust ok 100

    cPanel/WHM CVE-2026-41940 CRLF injection auth bypass exploit

    ★ 0 · created 2026-05-05

65. Rosemary1337/CVE-2026-41940 ↗Trust ok 100

    CVE-2026-41940 Exploit: cPanel & WHM Authentication Bypass

    ★ 0 · created 2026-05-01

66. sercanokur/CVE-2026-41940-cPanel-WHM-Verification-Tool ↗Trust ok 100

    This repository contains a Python verification script for `CVE-2026-41940`, a critical authentication bypass vulnerability disclosed in cPanel & WHM. > This project is intended for authorized defensive validation only. It is not intended for exploit development, unauthorized access, or misuse against systems you do not own or administer.

    ★ 0 · created 2026-05-04

67. SreejaPuthan/cpanel-control-plane-exposure-check ↗Trust ok 100

    Defensive exposure assessment tool for identifying externally accessible cPanel, WHM, and Webmail management interfaces related to CVE-2026-41940.

    ★ 0 · created 2026-05-09

68. tfawnies/CVE-2026-41940-next ↗Trust ok 100

    ★ 0 · created 2026-05-03

69. Underh0st/CPanel-Audit-Remediation-Tool ↗Trust ok 100

    Audit and incident response tool for CVE-2026-41940 vulnerability

    ★ 0 · created 2026-05-03

70. vineet7800/cpanel-malware-cleaner-cve-2026 ↗Trust ok 100

    cPanel malware, CVE-2026-41940, virus removal

    ★ 0 · created 2026-05-01

71. Wesuiliye/CVE-2026-41940 ↗Trust ok 100

    CVE-2026-41940利用工具（go并发检测，python利用）

    ★ 0 · created 2026-04-30

72. Xrzmodz444/cve-2026-41940-PoC-Linux ↗Trust ok 100

    CVE-2026-41940 PoC - Linux/Termux Compatible Version

    ★ 0 · created 2026-09-09

73. yanchenyu360/CVE-2026-41940-Security-Patch ↗Trust ok 100

    针对CVE-2026-41940漏洞的临时缓解措施

    ★ 0 · created 2026-08-13

74. ZildanZ/CVE-2026-41940 ↗Trust ok 100

    ★ 0 · created 2026-05-05

Fake proof-of-concept repositories have been used to deliver malware to the researchers who run them. The trust verdict is our engine's heuristic over the repository (account age, what it ships, how its stars arrived); it is a reason to read the code first, not a finding about its author.

Metasploit1

1. cPanel/WHM CRLF Injection Authentication Bypass RCE ↗

   Exploits CVE-2026-41940, a CRLF injection in cPanel/WHM's cpsrvd daemon that allows unauthenticated remote code execution as root. The Basic-auth handler writes the password to the raw session file without stripping newlines. Omitting the ob-part of the session cookie bypasses the encoder, so injected fields land verbatim in the raw file. A subsequent request to /scripts2/listaccts triggers Cpanel::Session::Modify to promote those fiel

   ruby · seen 2026-10-18

Exploit-DB1

1. cPanel - CRLF Injection ↗

   created 2026-05-26

Nuclei1

1. cPanel & WHM - Authentication Bypass via Session-File CRLF Injection ↗

   cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

   yaml · seen 2026-10-18