An authentication bypass flaw in the cPanel and WHM login flow allows an unauthenticated remote attacker to gain control of the management console. The vulnerability exploits improper authentication checks (CWE-306), enabling attackers to obtain privileged access without valid credentials, thereby threatening confidentiality, integrity, and availability of the hosted services.

The flaw applies to cPanel, L.L.C. installations with versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5. All affected releases of the cPanel & WHM product from cPanel, L.L.C. and WP Squared are vulnerable if they have not been updated to at least the specified version thresholds.

The CVSS score of 9.3 indicates critical severity, and while EPSS data is unavailable, the lack of a KEV listing does not diminish the risk because the vulnerability remains exploitable through the public network. Based on the description, it is inferred that attackers can trigger the login flow over HTTP/HTTPS and obtain an authenticated session, representing a high likelihood of exploitation if the server is exposed.