Authentication bypass vulnerability affecting cPanel & WHM
A critical vulnerability affecting cPanel & WHM would allow an unauthenticated malicious actor to gain unauthorized access to the administrative interface of affected systems.
Description
Technical context and vulnerability details
cPanel & WHM is a web hosting management platform providing centralized interfaces for server administration and site hosting. This product is affected by a vulnerability labeled CVE-2026-41940 resulting from a lack of proper validation in the login flow. This vulnerability is based on the manipulation of the session mechanism (in particular via the whostmgrsession cookie) combined with a CRLF-type injection. Exploitation of this vulnerability would allow an unauthenticated malicious actor to inject arbitrary session attributes leading to bypass of the authentication process and thus gaining unauthorized access within affected systems. It is classified critical with a severity score of 9.8 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Breach of confidentiality, integrity and availability of data;
- Unauthorized access;
- Compromise of system integrity;
Affected systems
Products, components and targeted versions
- cPanel & WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20 and 11.136.0.5;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update cPanel & WHM to its latest stable version depending on the branch used;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.