CWE-1392
CVEs classified under CWE-1392, newest first.
30 CVEsRSS
CVE-2026-77056High· 7.1Use of Default Credentials in boneIO
boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A re…
CVE-2026-19741High· 7.5OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd)
Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthread/Kconfig.thread (previously subsys/net/l2/openthread/Kconfig, then subsys/net/l2/openthread/Kconfig.thread). J01NME is the e…
CVE-2026-55457High· 7.4Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. Autho…
CVE-2026-77933Critical· 9.8PoCDB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment
DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet n…
CVE-2026-112296Critical· 9.8FlyCms through commit edfdf724 Default Super Administrator Credentials
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST …
CVE-2026-111998Critical· 9.8PoCVanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway…
CVE-2026-111693Critical· 9.8PoCDataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials
DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credent…
CVE-2026-111329Critical· 9.8PoCJuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090
JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deleti…
CVE-2026-108783High· 7.3PoCA security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2
A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part of the file app.py of the component Backup Download. The manipulation leads to use of default credentials. The attack…
CVE-2026-108263Critical· 9.9Astron Agent is an agentic workflow platform for building and running AI agents
Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engin…
CVE-2026-100103Critical· 10.0Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value
Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentiall…
CVE-2026-90924Critical· 9.8Use of default credentials vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd
Use of default credentials vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Try Common or Default Usernames and Passwords. This issue affects Logsign SIEM: from 6.4.101 before 6.4.…
CVE-2026-97064Critical· 9.1X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed
X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauthenticated attackers can authenticate as any user by submitting the public master code to the emai…
CVE-2026-97649Medium· 4.7PoCA flaw has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf
A flaw has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this vulnerability is an unknown functionality of the file example_lite.sql. Executing a manipulation can lead to u…
CVE-2026-90940Medium· 5.3PoCnovel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL …
novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL …
CVE-2026-90498High· 7.3PoCA vulnerability was identified in lenve vhr 1.0-SNAPSHOT
A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown functionality of the file vhr.sql. The manipulation leads to use of default credentials. Remote exploitation of the attack is possible. The …
CVE-2026-90456High· 8.1An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password
An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the s…
CVE-2026-90451Medium· 5.9⚖ disputedAn example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component
An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration w…
CVE-2026-78573Critical· 9.8IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials.
IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials.
CVE-2026-86464Critical· 9.9In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deployment included insecure default configurations and credentials for security-sensitive services. …
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deployment included insecure default configurations and credentials for security-sensitive services. …
GHSA-p77j-g7h5-r2vwHighGeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)
GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)
CVE-2026-68503Critical· 9.8PoCLazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework
LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payload_schema.py and passes them unchanged to lazyc…
GHSA-f25v-x6vr-962gCritical· 10.0Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password
Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password
CVE-2026-46386Critical· 9.9OpenProject is open-source, web-based project management software
OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERWRITE_ME as the default Rails master key. Combined with cookies_serializer = :m…
CVE-2026-31837High· 7.5Istio is an open platform to connect, manage, and secure microservices
Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a user of Istio is impacted if the JWKS resolver becomes unavailable or the fetch fails, exposing hardcoded defaults regardless …
CVE-2025-11943High· 7.3A vulnerability has been found in 70mai X200 up to 20251010
A vulnerability has been found in 70mai X200 up to 20251010. Affected by this vulnerability is an unknown functionality of the component HTTP Web Server. The manipulation leads to use of default credentials. The attack can be initiated r…
CVE-2025-34516Critical· 9.8Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a use of default credentials vulnerability that allows an unauthenticated attacker to obtain remote access
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a use of default credentials vulnerability that allows an unauthenticated attacker to obtain remote access. Ilevia has declined to service this vulnerability, and recommends …
CVE-2025-10542Critical· 9.8iMonitor EAM 9.6394 ships with default administrative credentials that are also displayed within the management client’s connection dialog
iMonitor EAM 9.6394 ships with default administrative credentials that are also displayed within the management client’s connection dialog. If the administrator does not change these defaults, a remote attacker can authenticate to the EA…
CVE-2025-9576Low· 2.5A vulnerability was identified in seeedstudio ReSpeaker LinkIt7688
A vulnerability was identified in seeedstudio ReSpeaker LinkIt7688. Impacted is an unknown function of the file /etc/shadow of the component Administrative Interface. The manipulation leads to use of default credentials. An attack has to…
CVE-2025-9577Low· 2.5A security flaw has been discovered in TOTOLINK X2000R up to 2.0.0
A security flaw has been discovered in TOTOLINK X2000R up to 2.0.0. The affected element is an unknown function of the file /etc/shadow.sample of the component Administrative Interface. The manipulation results in use of default credenti…