cPanel Patches Critical Exploited Auth Bypass Flaw

cPanel, a widely used web hosting control panel, released patches on April 28, 2026, for a critical authentication bypass vulnerability tracked as CVE-2026-41940 that has been actively exploited since late February or early March. The flaw, rated 9.8 out of 10 on the CVSS scale, affects all supported versions of cPanel and WebHost Manager (WHM) released after version 11.40, as well as WP Squared, a WordPress hosting management platform built on cPanel.

The vulnerability arises from a carriage return line feed (CRLF) injection during the login and session loading processes. Before verifying credentials, the cPanel service daemon, cpsrvd, writes a session file to disk based on input from the whostmgrsession cookie or Authorization header. Attackers can manipulate this by omitting expected cookie segments or injecting line breaks into the password field, bypassing encryption and sanitization. This allows insertion of properties such as "user: root," creating a preauthenticated session that grants administrative access without a valid password. Rapid7 researchers noted that internet scans via Shodan identified about 1.5 million cPanel instances exposed online, while around 70...