---
id: CVE-2026-121022
title: Default Administrator Password Change Not Enforced in Axxon One Web Client
summary: >-
  Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One
  before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to
  log in as the built-in administrator with the default credentials on a newly
  instal…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-1393
vendor: AxxonSoft
product: Axxon One
affected:
  - axxon_one < 3.0.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-03T20:16:24.186791Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T20:16:40.100Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121022'
references:
  - url: >-
      https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121022
tags:
  - cve.org
epss: 0.00378
epssPercentile: 0.32025
ingestedAt: '2026-11-05T20:33:06.438Z'
---

## Overview

Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login.

## Affected

- `axxon_one < 3.0.0`

## Remediation

Upgrade Axxon One to version 3.0.0 or later, where the web client requires the default password to be changed on first login.

### Workarounds

On earlier versions, change the default administrator password in the desktop client immediately after installation, before the web server is reachable from the network.