cPanel & WHM - Authentication Bypass (CVE-2026-41940)

cPanel and WHM contain an authentication bypass vulnerability in the login flow caused by CRLF injection in session file handling. The cpsrvd daemon writes session files to disk before authentication occurs, and an attacker can manipulate the whostmgrsession cookie and inject crafted lines via a malicious Basic Authorization header. The system writes the session file without sanitizing the data, allowing the attacker to insert arbitrary session properties such as user=root, achieving full administrative access without credentials.