CVE-2026-125384
CriticalCVSS 9.8Summary
INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability because the UserAdminSeeder creates [email protected] with password 123456. Attackers can log in with these credentials, which carry every admin role and no forced password change, to fully control deployments that kept them.
Risk Assessment
An unauthenticated attacker can gain full administrative access to the WHMS system, leading to data and configuration takeover. The risk is high for any deployment where default credentials were not changed.
Recommendation
Immediately change the default password for [email protected] and enforce a password change at first login. Update the system to version 10.20261109 or later.
Other vulnerabilities in INDOTALENT WHMS
See all- CVE-2026-125385Medium
INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbitrary files via the documentName and imageName parameters. Attackers can self-register and supply traversal sequences to GetDocument or GetImage, which use Path.Combine without containment checks, to read files like appsettings.json.
- CVE-2026-125383Critical
INDOTALENT WHMS before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the Tokens/DI.cs validator trusts, gaining administrator access to the entire API.
Original NVD description (English source)
INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates [email protected] with password 123456. Attackers can log in with these credentials, which carry every admin role and no forced password change, to fully control deployments that kept them.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS