CVE-2026-125384

Summary

INDOTALENT WHMS versions before 10.20261109 ship with hardcoded default credentials ([email protected] / 123456) for an administrative user created by UserAdminSeeder, granting full admin privileges without requiring a password change. This allows unauthenticated remote attackers to gain complete system control.

Exploitability

Trivial to exploit over the network with no authentication or user interaction required; only requires knowledge of the default credentials.

Blast radius

Successful exploitation grants full administrative access, enabling attackers to compromise all data, modify system configurations, deploy malware, or pivot laterally within the environment.

Detection

Log entries showing successful authentication from the IP address [email protected] with password '123456' in authentication logs; anomalous high-privilege API calls (e.g., /api/admin/*) immediately following initial login without prior user activity.

Prioritized remediation

Upgrade to INDOTALENT WHMS version 10.20261109 or later, which removes the default admin account and enforces secure provisioning.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.