WHM root login with 2FA succeeds, but no successful login entry written to login_log

Hi cPanel team,

I’m trying to clarify what the authoritative signal is for a successful WHM root login on recent cPanel builds when 2FA is enabled, as traditional logging no longer appears reliable.

Environment:

• cPanel & WHM (current / fully updated)

• AlmaLinux 9

• WHM access on port 2087

• Root logins

• WHM 2-Factor Authentication (TOTP) enabled

• No CSF (Imunify used, but not relevant here)

What I’m seeing:

When logging into WHM as root (password + 2FA), the login is successful and the WHM dashboard loads normally.

However:

1. No successful login entry is written to

   /usr/local/cpanel/logs/login_log

2. The only related entry in cPanel logs is from whostmgrd, for example:

   [2025-12-26 11:35:13 +0200] info [whostmgrd] 127.0.0.1 - root "GET / HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing

   This appears to represent the pre-2FA phase only.

3. There is no subsequent “LOGIN SUCCESS” entry anywhere in whostmgrd logs or login_log, even though the session is fully authenticated and usable as root.

What does confirm the login:

The only place I can conclusively confirm a successful WHM root login is in:

Specifically, the appearance of authenticated cpsess URLs returning HTTP 200, for example:

My understanding (and testing) shows that:

• Access to /cpsess*/ with HTTP 200

• As user root

• On port 2087

cannot occur unless authentication (including 2FA) has completed successfully.

This appears to be the only reliable post-2FA indicator of a successful WHM root login.

Questions:

1. Is this behaviour expected on recent cPanel versions with WHM 2FA enabled?

2. Is it correct that:

   • login_log may not receive a success entry for WHM root logins using modern 2FA flows?

3. If so, is parsing /cpsess*/ access in access_log now the only reliable way to audit or alert on successful WHM root logins?

4. Is there a documented hook, event, or API that cPanel recommends for detecting successful WHM authentication (including 2FA), instead of relying on log scraping?

This is important for security monitoring and alerting, as traditional approaches (CSF-style log parsing) no longer appear to work reliably.

Thanks in advance for clarification.