A critical vulnerability in cPanel & WHM’s cpsrvd daemon lets unauthenticated attackers gain full administrative access to a WHM server — no password required.
The flaw, tracked as CVE-2026-41940, is a CRLF injection in both the whostmgrsession cookie and the Authorization headers. By injecting carefully crafted session parameters, an attacker can poison the server’s flat-file session store. The payload sets user=root, hasroot=1, and tfa_verified=1, effectively telling the system the attacker has already authenticated and has root privileges.
The attack works in three stages. First, the attacker obtains a pre-auth session by submitting a fake login, noting the session ID from the Set-Cookie response. Then, they inject the CRLF-poisoned Authorization header to overwrite the session metadata. Finally, the server responds with a valid admin session token — a /cpsessXXXXXXXXXX/ URL — granting full WHM control.
The CVE falls under CWE-93 (Improper Neutralization of CRLF Sequences). A public proof of concept exists on GitHub under the nu11secur1ty repository.
The researcher rated this MEDIUM to HIGH severity but in practice it’s effectively a full authentication bypass. Any internet-facing cPanel/WHM server running version 11.40 should be treated as compromised if not patched.
