What is cve-2026-41940-poc?

CVE-2026-41940-PoC is a Python tool that demonstrates a critical authentication bypass vulnerability in cPanel and WHM, two widely used web hosting control panel platforms. The vulnerability is rated CVSS 10.0, the highest severity score, meaning an attacker can gain full administrative access to a server without providing any credentials at all. The flaw works by exploiting how cPanel and WHM handle login sessions. The server creates and partially initializes a session before fully checking whether the user has valid credentials. By sending crafted input through the Authorization header, an attacker can manipulate how session data is written to server-side files, ultimately tricking the system into treating the request as authenticated. The tool, written as a Python script, accepts a target URL and can test a single server or work through a list of targets in parallel. Once the bypass succeeds, it provides post-access commands for reading files, executing operating system commands, listing hosted accounts, changing the root password, and opening an interactive shell. Six version ranges of cPanel and WHM are listed as affected, with specific patch versions identified for each. The README states the tool is created solely for educational purposes and bug bounty programs, and that unauthorized use outside of controlled environments is prohibited. Bug bounty programs are schemes where software vendors pay security researchers to find and report vulnerabilities before malicious actors do. This is a security research repository. Running it against systems you do not own or have explicit written permission to test is illegal in most jurisdictions.