Most security scanning pipelines fail silently against real-world cPanel deployments. When auditing for the authentication bypass tracked as CVE-2026-41940, naive probes consistently generate false negatives or get immediately choked by native protection layers like cphulkd and authorized_whm_root_ips. Auditing this flaw requires an understanding of how session handling, proxy routes, and defense daemons interact under the hood.

The tool cpanel2shell-scanner solves this detection problem by decoupling vulnerability verification from intrusive credential brute-forcing.

The Architectural Blindspots in Standard Scanners

Traditional vulnerability checks fall into predictable traps when evaluating cPanel and WHM environments:

1. Port Isolation: Audits often check only the standard management ports (2082, 2083, 2086, 2087). If an administrator firewalls these ports and relies strictly on Apache proxy paths on port 443, standard scanners report the service as absent or safe.
2. Defensive Lockout Triggers: Naive probes attempt active credential checks that trigger cphulkd account lockouts.
3. Whitelist Restrictions: Probing against protected administrative endpoints runs directly into authorized_whm_root_ips enforcement, cutting off the audit before gathering diagnostic data.

To bypass these hurdles, cpanel2shell-scanner targets standard ports alongside Apache proxy paths like /___proxy_subdomain_whm and /___proxy_subdomain_cpanel over port 443.

Mechanics of the Safe Detection Flow

The scanner confirms the presence of CVE-2026-41940 without executing shells, without escalating privileges, and without targeting real root credentials. The mechanism exploits a newline injection flaw within the session setup protocol.

+---------------+     1. GET /login (Extract Cookie)     +---------------+
|               | -------------------------------------> |               |
|               |     2. GET / (Basic Auth + \n)        |               |
|    Scanner    | -------------------------------------> | cPanel / WHM  |
|               |     3. Parse Location Header (cpsess)  |    Target     |
|               | <------------------------------------- |               |
|               |     4. GET /<cpsess>/ (Check Marker)   |               |
|               | -------------------------------------> |               |
+---------------+                                        +---------------+

The underlying verification sequence executes in four deterministic steps:

1. Session Name Retrieval: The scanner sends a GET /login request to extract the baseline session cookie name for WHM or cPanel from the Set-Cookie header.
2. Header Injection: A GET / request is dispatched containing a crafted authorization header: Authorization: Basic <user>:\xff\nexpired=1 The injected \nexpired=1 string manipulates internal session parameters directly.
3. Token Extraction: The scanner inspects the response's Location header to parse out the generated session token format (cpsessXXXX).
4. State Verification: A final request targets /<cpsessXXXX>/ using the initial session cookie. If the target is vulnerable, the server confirms session parameter manipulation by returning the explicit string marker: msg_code:[expired_session].

Divergent Strategy: WHM vs. cPanel

The backend handles user evaluation differently depending on the service context. The scanner adapts its methodology accordingly:

Target Surface	Input Strategy	Defensive Interaction
WHM	Random usernames	Does not target root; avoids cphulkd and authorized_whm_root_ips triggers entirely.
cPanel	Wordlist of common usernames	Requires a valid on-disk user; halts immediately upon the first matching hit to confirm vulnerability.

Because WHM processes the injected parameter state regardless of whether the account exists, random usernames are sufficient to confirm the flaw without tripping root-level monitoring. For cPanel, iterating through a username wordlist until finding an existing account validates the injection state cleanly.

Deployment and Usage

The utility requires Python 3.8+ and installs standard dependencies directly:

bash
pip install -r requirements.txt

Core Execution Patterns

Evaluate a single endpoint:

bash
python scanner.py example.com

Audit multiple targets with custom port specifications:

bash
python scanner.py host-a.example.com host-b.example.com:2083

Ingest batch targets via file or standard input:

bash
python scanner.py -f targets.txt
cat targets.txt | python scanner.py

CLI Flag Reference

• -u, --users: Supply a custom cPanel username list directly.
• -U, --users-file: Load target cPanel usernames from an external file.
• -p, --ports: Specify fallback ports to probe if omitted in the target string.
• -t, --threads: Adjust thread counts per target during cPanel username spraying.
• -c, --concurrency: Control the global concurrency limit for parallel target scanning.
• -T, --timeout: Configure network request timeout values.
• -o, --output: Write confirmed vulnerable hosts to a destination file.
• --json: Output findings in JSON Lines format for log ingestion pipelines.
• -q, --quiet: Suppress standard diagnostic messages and stream only vulnerable hosts to stdout.

Safe Auditing by Design

Reliable vulnerability discovery requires distinguishing between functional verification and destructive exploitation. cpanel2shell-scanner achieves reliable detection by strictly looking for the msg_code:[expired_session] response artifact. It avoids false negatives caused by proxy layers and prevents false positives without destabilizing production host configurations.

Reference

• https://github.com/assetnote/cpanel2shell-scanner