# cPanelSniper: a CVSS 10.0 exploit chain with no dry-run and no scope check

> cPanelSniper is a single file Python tool for CVE-2026-41940, an authentication bypass in cPanel and WHM, and its own documentation says it is for authorized penetration testing and bug bounty programs only. The vulnerability it targets is a clean example of a sanitiser running in the wrong order, and the tool around it is a bulk scanner with discovery pipelines and post-exploit actions that include creating a second administrator account.

**ynsmroztas/cPanelSniper** — CVE-2026-41940 — cPanel & WHM Authentication Bypass via Session-File CRLF Injection

- Repository: https://github.com/ynsmroztas/cPanelSniper
- Stars: 507 · Forks: 139
- Language: Python
- License: not declared
- Published: 2026-09-20 · Updated: 2026-09-20 · Language: en
- Canonical page: https://hysenlabs.com/projects/ynsmroztas-cpanelsniper

## The bug is a sanitiser that runs after the write

The root cause the file describes is an ordering mistake in cPanel's own Perl session handling, and it is worth reading on its own. The session saving routine writes the session file to disk first and calls its filtering function afterwards. That means carriage return and line feed sequences embedded in the value of an Authorization header are persisted into the session file verbatim, before any sanitisation runs, and the authentication check that follows reads the poisoned file back. The file lays the two orders out side by side: the normal path filters, then writes, then checks; the vulnerable path writes with the injected content already in it, then filters a file that already contains the injected fields, then checks. Nothing about that requires unusual conditions. It is an unescaped value reaching a structured file format: the session record is a list of key and value pairs, the credential arrives as a base64 style basic authentication value that the server decodes before storing it, and the decoded text is not escaped for the format it is about to be written into. Whatever the caller put in that value therefore becomes additional lines in a file the authentication path treats as authoritative session state. The fix is a reordering, and the vendor appears to have shipped it on every maintained branch.

## The patch table is the most useful part of the file

Six branches are listed with the last vulnerable build and the first patched one, and in every case the fix is the very next build number. Branch 110 is vulnerable through 11.110.0.96 and patched in 11.110.0.97. Branch 118 through 11.118.0.62, patched in .63. Branch 126 through 11.126.0.53, patched in .54. Branch 132 through 11.132.0.28, patched in .29. Branch 134 through 11.134.0.19, patched in .20. Branch 136 through 11.136.0.4, patched in .5. The scale claims sit alongside that table: a CVSS score of 10.0 rated critical, exploitation in the wild confirmed in April 2026, and an estimate of roughly 70 million domains running cPanel and WHM. Those numbers are the project's own assertions rather than independent measurement, but the shape of the patch table is the part that survives contact with reality, because a fix that is always the next build is a fix an operator can apply without a version-support question. What the table does not cover is any branch outside those six, so an installation on an older or long-term-support branch has to work out its own answer, and the file offers no guidance for that case.

## It takes a URL list and never checks whether you may touch it

This is the section that decides whether the tool is usable inside a scope, and the answer is that it contains no mechanism for one. The documented options include a single target URL, a file of URLs with one per line, a thread count defaulting to ten with examples raising it to twenty or thirty, a timeout, and a rate limit. There is no dry-run mode, no allow-list, no scope file the tool validates targets against, and no per-host authorization check anywhere in the documented interface. The rate limit is a throttle, not a boundary. Worse for scoping, Worse for scoping, the file's own examples are pipelines that take output from third-party discovery tools, a subdomain enumerator and an HTTP prober, and from a search engine query, and feed the results straight into the target list, so the set of hosts the tool touches is decided by someone else's enumeration rather than by your scope document. It also accepts a single URL on standard input, and it writes what it finds to an output file, which means one bulk run against a generated host list produces a machine readable record of every host where the bypass succeeded.

## Two post-exploit commands change state on the server

After a successful bypass the tool offers an interactive prompt, and its command table lists what that prompt can do. Most of it reads: identity and hostname, the panel version, load, disk and database host, the list of cPanel accounts with their domains and email addresses, file reads, directory listings, a raw call into the panel's JSON API with arbitrary key and value pairs. Two entries are not reads. One creates an additional panel administrator with a name and password the caller supplies, described in the file itself as creating a backdoor administrator. The other changes the root password. How to invoke either is deliberately not reproduced here, and the reason is the whole point: a tool that can silently add an administrator to a host is not a tool you point at a range to see what happens, and a tool whose scope checks are a rate limit cannot be trusted to stop itself at the edge of an authorization. Treat both capabilities as the boundary condition for any use of this repository. The same applies to the raw panel API call, which hands an authenticated session an arbitrary endpoint with arbitrary parameters, and to the file read and command execution entries, which together make the panel a shell with a nicer prompt.

## Three files, no licence, and no tests

The repository contains three things: the readme, a screenshot, and one Python file. There is no licence document anywhere in the listing and the repository records no licence identifier, so the default position is the one that applies when nothing is granted, and anyone planning to run, modify or redistribute this code should establish permission first rather than infer it. There is also no test suite, no continuous integration configuration, no dependency manifest, and no tagged release, which is not surprising for a single-file script but does mean there is nothing to check a change against. The file itself is honest about being dependency-free, describing itself as pure standard library with no installer step and Python 3.8 or newer, and the acquisition path is a clone and a help invocation:

```bash
git clone https://github.com/ynsmroztas/cPanelSniper
cd cPanelSniper
python3 cPanelSniper.py --help
```

Nothing else is needed to run it, which is convenient for an operator and worth remembering as a property of the tool rather than a convenience of the documentation. That property is also why the file's own framing line matters: it says the tool is for authorized penetration testing and bug bounty programs only, and it is the only place in the repository where a boundary is stated at all.

## The readme stops mid-diagram three separate times

Three sections end in the middle, which tells you something about how much of this was written to be read rather than to be archived. The four-stage chain diagram stops partway through stage two, mid-line, after describing the discovery request and the pre-authentication session step. The pipeline examples stop inside a brace after the first command of the combined sources case, so the last example is unusable as printed. The command line reference stops right after the thread count line, leaving a dangling dash and no coverage of the remaining flags, including the ones that matter for scoping. None of that is fatal, because the parts that are cut are the parts that would describe the exploit in full detail. What survives is enough to understand the class of the bug, enough to patch, and enough to run the tool. The chain diagram names a canonical hostname discovery step and a step that obtains a session before authentication succeeds, which tells you the tool needs to talk to the panel before it can attack it, and that the port it expects is the secure one rather than the plain HTTP port, with a documented option to override the host header when a panel sits behind a proxy that answers on a different name.

## One link to a CVE record, one to a personal account

The header carries three badge-style links with no text, pointing at the Python site, at the national vulnerability database entry for the CVE, and at the author's account on a social network. Two of those are exactly where a reader would go to check the claims independently, which is to the author's credit. The third is a personal account, which is an odd thing to leave in a repository whose whole subject is a vendor vulnerability. The version picture matters more: the last recorded push to the default branch is 2026-05-01, the file says exploitation in the wild was confirmed in April 2026, and there is still no tagged release. So the tool that arrived a few weeks after the exploitation reports are documented only as a branch head. The repository has no tagged releases, no topics and no homepage field, and the three files it contains are the readme, one image and the script itself, which is the whole of what a reader is asked to trust.

## Conclusion

Two things are separable here and should be. The underlying bug is worth understanding whether or not you run anything: a session file written before its contents are sanitised is an ordering mistake with an obvious fix and an obvious blast radius, and the six-branch patch table is the part to act on. The tool is a different matter. It is a working exploit chain with a bulk scanner, third-party discovery pipelines, and a post-exploit command set that can create a second administrator and change the root password, and it ships no dry-run, no allow-list and no per-host authorization check to stop any of it running against something you do not own. Do not point it at a host outside a written scope, do not feed it the output of an internet-wide enumeration tool unless that scope is genuinely yours, and note that the repository declares no licence at all, which is its own answer to whether you may redistribute or even rely on it.

## FAQ

### What is cPanelSniper?

It is a single file Python tool described as an exploitation framework for CVE-2026-41940, a critical authentication bypass affecting cPanel and WHM. The file states it is for authorized penetration testing and bug bounty programs only, and that it uses nothing outside the Python standard library on 3.8 or newer.

### What is the root cause of CVE-2026-41940?

The session handling code writes the session file to disk before calling the function that filters its contents. Carriage return and line feed sequences in an Authorization header value are therefore persisted into the file before sanitisation, and the subsequent authentication check reads the poisoned file.

### Which cPanel and WHM versions are patched for CVE-2026-41940?

Six branches, each fixed in the next build: branch 110 at 11.110.0.97, branch 118 at 11.118.0.63, branch 126 at 11.126.0.54, branch 132 at 11.132.0.29, branch 134 at 11.134.0.20, and branch 136 at 11.136.0.5.

### Does cPanelSniper have any built-in scope control?

Not in its documented options. There is no dry-run mode, no allow-list and no per-host authorization check; the only throttle is a rate limit. The file's own examples pipe the output of third-party discovery tools and a search engine query straight into the target list.

### What can the cPanelSniper shell do after a successful bypass?

The documented prompt can read identity, panel version, load, disk, account listings, files and directories, and it can call the panel's raw JSON API. Two documented commands change state on the server: one creates an additional panel administrator, and one changes the root password.

### Is cPanelSniper licensed?

No licence is declared. The repository records no licence identifier, and its three top level files, consisting of the readme, a screenshot and the script, contain no licence document, so nothing grants permission to use or redistribute it.

## Sources

- [Issues](https://github.com/ynsmroztas/cPanelSniper/issues)
- [README](https://github.com/ynsmroztas/cPanelSniper/blob/main/README.md)
- [ynsmroztas/cPanelSniper on GitHub](https://github.com/ynsmroztas/cPanelSniper)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/ynsmroztas-cpanelsniper