PCI Compliance Dispute: Request for Vendor Confirmation of Webmail Session-Expiration Behavior (v11.138.0.15)

ehask71

• October 20, 2026 04:18

We are currently resolving a PCI-DSS compliance audit failure regarding "Insufficient Session Expiration" flagged on our webmail interface (Port 2096). Our server is currently running cPanel & WHM version 11.138.0.15. [1, 2]

To satisfy our Approved Scanning Vendor's (ASV) appeal process, we require direct vendor verification of the system's session management architecture. Could you please officially confirm the following details regarding this specific build:

• Direct Session Invalidation: When a direct Webmail session expires or an invalid/expired session cookie is processed, how does the cPanel binary handle cookie replacement and session termination? [1, 2]

• Redirect-Loop Countermeasures: Does this version intentionally drop short-lived or unflagged invalidation cookies to prevent browser redirect loops for expired sessions? [1, 2]

• Security Boundaries: Can these specific transitional or validation-failure cookies be leveraged to hijack or authenticate into an active, secure webmail session? [1, 2]

Your formal confirmation will serve as our official vendor documentation to prove this flag is a false positive. [1]

• 

  cPRex Jurassic Moderator

  • October 20, 2026 13:58

  Hey there!  I'll answer these in order to make sure I don't miss anything.

  Direct Session Invalidation: If the session is expired on the server, cPanel sends invalid session cookies to the client, which keeps the browser from using old session information.  It's possible that your PCI scan flagged session_locale on port 2096 for lacking HttpOnly, but it does have Secure, and other cookies get HttpOnly. That is a separate cookie from the session cookie.

  Redirect loop countermeasures: we actually do the opposite. The loop countermeasure is for cPanel to send invalidation cookies when the server has expired the session. Those cookies tell the browser to discard the stale session. Dropping them would bring the loop back. The invalidation cookie is sent without the Secure flag. This lets it clear a session whether the user was on a secure or non-secure Webmail session. Security considers this acceptable because the cookie is invalid and is only returned over HTTPS. Insecure Webmail logins are also off by default.

  Security Boundaries: No, the above system prevents this from happening.

  0
• 

  ehask71

  • October 20, 2026 15:21

  Can you confirm that the cookies lacking HttpOnly or Secure on Webmail port 2096 contain no reusable authentication credentials, and that an expired session cannot be restored using those cookies?

   

  0
• 

  cPRex Jurassic Moderator

  • October 20, 2026 15:22

  That's correct - those are the separate cookie from the session, and wouldn't contain any session details.

  0
• 

  ehask71

  • October 20, 2026 21:36
  • Edited

   Can you confirm that "timezone" is not responsible for starting or maintaining an authenticated session?

  0
• 

  cPRex Jurassic Moderator

  • October 21, 2026 17:04

  It is my understanding that the timezone cookie is a UI preference cookie, and doesn't have any interesting information related to the authenticated session.

  0
• 

  Julia User

  • October 27, 2026 09:35

  This is an important distinction between session invalidation behavior and an actual session hijacking vulnerability. Has cPanel Support provided any build-specific documentation or technical clarification for version 11.138.0.15? It would be useful to obtain an official statement explaining how expired-session cookies are handled so the ASV can properly assess the finding rather than dismissing it as a false positive.

  0
• 

  cPRex Jurassic Moderator

  • October 27, 2026 13:25

  Julia User - if you need more specifics than what I've provided here it would be best to create a ticket so we can examine your particular situation.

  0

Please sign in to leave a comment.