CVE-2026-41940

🗓️ 29 Apr 2026 15:10:37Reported by VulnCheckType

cve🔗 web.nvd.nist.gov📰️ 121 Media mentions👁 1159 Views🌐 WEB

Authentication bypass in cPanel login flow allows unauthenticated remote access on older versions.

Reporter	Title	Published	Views	Family All 192
GithubExploit	Exploit for Missing Authentication for Critical Function in Cpanel	1 May 202616:27	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Cpanel	13 Aug 202616:03	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Cpanel	6 Jun 202612:49	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Cpanel	27 May 202600:16	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Cpanel	8 May 202614:05	–	githubexploit
GithubExploit	indo-cpanel-exploit	26 May 202619:59	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Cpanel	5 May 202623:39	–	githubexploit
GithubExploit	Exploit for CVE-2026-41940	30 Apr 202617:08	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Cpanel	23 Jul 202615:42	–	githubexploit
GithubExploit	Exploit for CVE-2026-41940	30 Apr 202608:11	–	githubexploit

NVD

Vulners

CNA

Node

cpanel cpanelRange11.40–86.0.41

cpanel cpanelRange88.0.0–110.0.97

cpanel cpanelRange112.0.0–118.0.63

cpanel cpanelRange120.0.0–124.0.35

cpanel cpanelRange126.0.1–126.0.54

cpanel cpanelRange128.0.0–130.0.19

cpanel cpanelRange132.0.0–132.0.29

cpanel cpanelRange134.0.0–134.0.20

cpanel cpanelRange136.0.0–136.0.5

Node

cpanel whmRange11.40–86.0.41

cpanel whmRange88.0.0–110.0.97

cpanel whmRange112.0.0–118.0.63

cpanel whmRange120.0.0–124.0.35

cpanel whmRange126.0.1–126.0.54

cpanel whmRange128.0.0–130.0.19

cpanel whmRange132.0.0–132.0.29

cpanel whmRange134.0.0–134.0.20

cpanel whmRange136.0.0–136.0.5

Node

cpanel wp_squaredRange<136.1.7wordpress

[
  {
    "defaultStatus": "affected",
    "vendor": "WebPros",
    "product": "cPanel",
    "versions": [
      {
        "status": "affected",
        "version": "11.40.0.0",
        "versionType": "custom",
        "lessThan": "11.86.0.41"
      },
      {
        "status": "affected",
        "version": "11.88.0.0",
        "versionType": "custom",
        "lessThan": "11.94.0.28"
      },
      {
        "status": "affected",
        "version": "11.96.0.0",
        "versionType": "custom",
        "lessThan": "11.102.0.39"
      },
      {
        "status": "affected",
        "version": "11.104.0.0",
        "versionType": "custom",
        "lessThan": "11.110.0.97"
      },
      {
        "status": "affected",
        "version": "11.112.0.0",
        "versionType": "custom",
        "lessThan": "11.118.0.63"
      },
      {
        "status": "affected",
        "version": "11.120.0.0",
        "versionType": "custom",
        "lessThan": "11.124.0.35"
      },
      {
        "status": "affected",
        "version": "11.126.0.0",
        "versionType": "custom",
        "lessThan": "11.126.0.54"
      },
      {
        "status": "affected",
        "version": "11.128.0.0",
        "versionType": "custom",
        "lessThan": "11.130.0.19"
      },
      {
        "status": "affected",
        "version": "11.132.0.0",
        "versionType": "custom",
        "lessThan": "11.132.0.29"
      },
      {
        "status": "affected",
        "version": "11.134.0.0",
        "versionType": "custom",
        "lessThan": "11.134.0.20"
      },
      {
        "status": "affected",
        "version": "11.136.0.0",
        "versionType": "custom",
        "lessThan": "11.136.0.5"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "vendor": "WebPros",
    "product": "WP Squared",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThan": "11.136.1.7"
      }
    ]
  },
  {
    "defaultStatus": "affected",
    "vendor": "WebPros",
    "product": "WHM",
    "versions": [
      {
        "status": "affected",
        "version": "11.40.0.0",
        "versionType": "custom",
        "lessThan": "11.86.0.41"
      },
      {
        "status": "affected",
        "version": "11.88.0.0",
        "versionType": "custom",
        "lessThan": "11.94.0.28"
      },
      {
        "status": "affected",
        "version": "11.96.0.0",
        "versionType": "custom",
        "lessThan": "11.102.0.39"
      },
      {
        "status": "affected",
        "version": "11.104.0.0",
        "versionType": "custom",
        "lessThan": "11.110.0.97"
      },
      {
        "status": "affected",
        "version": "11.112.0.0",
        "versionType": "custom",
        "lessThan": "11.118.0.63"
      },
      {
        "status": "affected",
        "version": "11.120.0.0",
        "versionType": "custom",
        "lessThan": "11.124.0.35"
      },
      {
        "status": "affected",
        "version": "11.126.0.0",
        "versionType": "custom",
        "lessThan": "11.126.0.54"
      },
      {
        "status": "affected",
        "version": "11.128.0.0",
        "versionType": "custom",
        "lessThan": "11.130.0.19"
      },
      {
        "status": "affected",
        "version": "11.132.0.0",
        "versionType": "custom",
        "lessThan": "11.132.0.29"
      },
      {
        "status": "affected",
        "version": "11.134.0.0",
        "versionType": "custom",
        "lessThan": "11.134.0.20"
      },
      {
        "status": "affected",
        "version": "11.136.0.0",
        "versionType": "custom",
        "lessThan": "11.136.0.5"
      }
    ]
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow
docs	www.docs.cpanel.net/release-notes/release-notes
namecheap	www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026
docs	www.docs.wpsquared.com/changelogs/versions/changelog/
support	www.support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026
bleepingcomputer	www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/
github	www.github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
labs	www.labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/

Parameter	Position	Path	Description	CWE
user	request body	/login	Mint a pre-auth session to obtain a whostmgrsession cookie.	CWE-306
pass	request body	/login	Mint a pre-auth session to obtain a whostmgrsession cookie.	CWE-306
Authorization	header	/	CRLF injection via Basic-auth header to land payload in the raw cpsrvd session.	CWE-306
Cookie	header	/	CRLF injection via Basic-auth header to land payload in the raw cpsrvd session.	CWE-306
Cookie	header	/scripts2/listaccts	Trigger session field promotion to the authoritative cache.	CWE-306
Cookie	header	/{token}/json-api/version	Verify auth bypass by querying json-api/version with the bypassed session.	CWE-306
user	body	/{token}/json-api/passwd	Set a temporary root password via the WHM JSON API passwd endpoint.	CWE-306
password	body	/{token}/json-api/passwd	Set a temporary root password via the WHM JSON API passwd endpoint.	CWE-306

30 Sep 2026 18:18Current

8.8High risk

Vulners AI Score8.8

CVSS 49.3

CVSS 3.19.8

EPSS0.98527

SSVC