cPanel 2FA Bypass Exposes Tens of Millions of Websites to Hack

Digital Defense, Inc., a leader in vulnerability and threat management solutions, announced that its Vulnerability Research Team (VRT) exposed a previously undisclosed vulnerability affecting the cPanel & WebHost Manager (WHM) web hosting platform.

cPanel & WHM is a suite of tools built for Linux OS that enables hosting providers and users the ability to automate server management and web hosting tasks. The software suite is currently used to manage above 70 million domains across the globe.

Many cPanel & WHM interfaces create URIs to other interfaces by incorporating user-supplied data in URI query parameters. These interfaces were using URL encoding on the parameters rather than URI encoding. Due to this fault, a cPanel & WHM user could be misled into performing actions they did not intend.

The cPanel &WHM version 11.90.0.5 (90.0 Build 5) exhibits a two-factor authentication bypass defect, susceptible to brute force attack.

 An attacker with knowledge of or access to valid credentials could evade two-factor authentication protections on an account. Digital Defense’s in-house testing demonstrated that an attack will be get done in minutes.

“The two-factor authentication cPanel Security Policy did not prevent an attacker from repeatedly submitting two-factor authentication codes. This allowed an attacker to bypass the two-factor authentication check using brute force techniques.” reads a security advisory released by the company. 

This problem was addressed with the release of the following builds:

  • 11.92.0.2
  • 11.90.0.17
  • 11.86.0.32

The Digital Defense, Vulnerability Research Team right away makes contact with the affected vendor to notify the organization of the new finding(s) and help out, wherever possible, with the vendor’s remediation actions.

“Our standard practice is to work in tandem with organizations on a coordinated disclosure effort to facilitate a prompt resolution to a vulnerability. We will continue outreach to customers ensuring they are aware and able to take action to mitigate any potential risk introduced by the vulnerability,” states Mike Cotton, senior vice president of engineering at Digital Defense.”

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

Ensiko – A PHP Based Web Shell with Ransomware Capabilities Attacks PHP Installation

Hackers using weaponized TeamViewer to Attack & Gain Full Control of the Government Networks

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Xanthorox AI: New Automated Hacking Tool Surfaces on Hacker Forums

A new malicious AI tool, Xanthorox AI, has emerged on underground hacker forums. Dubbed the "Killer…

5 minutes ago

Apollo Router Vulnerability Enables Resource Exhaustion via Optimization Bypass

A critical vulnerability (CVE-2025-32032) has been identified in Apollo Router, a widely used GraphQL federation…

42 minutes ago

WhatsApp for Windows Flaw Allowed Remote Code Execution via File Attachments

A critical vulnerability identified as CVE-2025-30401 was recently disclosed, highlighting a major security flaw in WhatsApp for…

1 hour ago

PoC Exploit Reveals SSH Key Exposure via Yelp Vulnerability on Ubuntu

Security researchers have uncovered a critical vulnerability (CVE-2025-3155) in Ubuntu's default help browser Yelp that…

2 hours ago

Threat Actors Exploit Toll Payment Services in Widespread Hacking Campaign

In a sophisticated cybercrime operation, the Smishing Triad, a China-based group, has been identified as…

11 hours ago

Everest Ransomware Gang’s Leak Site Hacked and Defaced

TechCrunch has uncovered a concerning development in consumer-grade spyware: a stealthy Android monitoring app that…

11 hours ago