An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that component's administrative interface to anyone aware of the default value.

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value will use the known default, allowing an attacker aware of the default to forge valid authentication coo

该条目来自 NVD，描述 CVE-2026-90456：某打包分发的库存管理组件（inventory-management component）在随附的“示例环境配置文件”中内置了一个固定且公开可知的管理员口令。该示例文件本身是部署模板，正常情况下安装或初始化流程（setup routine）会重新生成随机凭据后再写入生效配置；但若部署人员为图省事，直接将示例文件原样复制为生产环境配置，并且跳过了会重新生成凭据的初始化步骤，组件就会在管理员接口上继续保留这个众所周知的默认口令。任何知晓该默认值的人，只要能到达该组件的管理接口，便可凭此通过身份认证，进而以管理员权限操作该组件，包括查看和修改库存数据、调整配置等。NVD 未提供 CVSS 评分、EPSS 分值、受影响产品与厂商信息，也未将该漏洞列入 KEV，且来源字段未标记存在在野利用。因此当前可确认的风险点集中在“静态且公开的管理员凭据”与“管理接口可达性”的叠加：攻击者无需口令猜测、凭据填充或社工即可完成认证，而默认口令类问题通常不会触发告警，容易在资产台账中被长期忽略。由于缺少受影响版本范围，无法精确圈定暴露面。

CVE-2026-90451 描述的是一类典型的“不安全默认配置/硬编码密钥”缺陷。受影响产品在发布时随附了一份示例环境配置文件（例如示例 .env 或类似的环境变量模板），其中用于对某个内置的数据包分析（packet-analysis）组件签发认证 Cookie 的签名密钥被设置为一个固定且公开可知的默认值。该默认值随源码或安装包一同分发，任何获取到该产品发行物、文档或公开仓库的人都能获知这一密钥。 问题的关键在于部署流程的设计假设：厂商提供的安装/初始化例程（setup routine）本应在部署时重新生成一个随机的、每实例唯一的签名密钥，并写入真实生效的配置文件。然而，如果管理员在部署时直接将这份示例配置文件复制为生产环境的实际配置，而没有执行该初始化例程（或初始化步骤因故失败、被跳过），系统就会继续使用这个众所周知的默认密钥来签发和校验认证 Cookie。 由此产生的安全后果是：攻击者只要知晓该默认密钥（无需任何漏洞利用代码或权限），就可以自行构造出签名合法的认证 Cookie，冒充已认证用户访问那个内置的数据包分析组件，从而绕过身份认证。由于签名密钥是公开且固定的，攻击者不需要先入侵系统、也不需要猜测或爆破，攻击门槛极低。该类问题的严重程度高度依赖该数据包分析组件所暴露的网络位置与权限：若该组件可从网络访问且具备较高权限，则可能进一步导致敏感网络流量数据泄露或被篡改。 需要注意的是，这是一类“配置相关”的风险而非内存破坏型漏洞，其是否可被实际利用取决于目标部署是否真的沿用了默认配置。因此修复与排查的核心在于：确认生产配置中该密钥是否仍为示例默认值，若为默认值则立即轮换为高熵随机值，并使已签发的旧 Cookie 失效。

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials.

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials.

Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials.

GeoLens 1.2.4 fixes a set of vulnerabilities, the most serious of which allow authenticated or anonymous users to obtain data and metadata for datasets they are not authorized to access. ### Impact - **Private record metadata disclosure.** Record contact, keyword, and distribution sub-resource endpoints did not re-authorize the backing dataset, so any authenticated user could read a private reco

A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations sets a fixed, hard-coded x11vnc password. Because the same credential is applied to every workstation provisioned this way, an attacker with adjacent-network access who knows the password can gain VNC access to affected workstations.

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payload_schema.py and passes them unchanged to lazyc2.py HTTP Basic authentication, allowing any network-reachable attacker who knows the defaults to authenticate to the C2 dashboard with operator-level access. This

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payload_schema.py and passes them unchanged to lazyc2.py HTTP Basic authentication, allowing any network-reachable attacker who knows the defaults to authenticate to the C2 dashboard with operator-level access. This

Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote attackers to gain administrative access by using default credentials identical across all installations. Attackers can authenticate to the exposed WildFly management console on port 20990 and deploy a malicious Web Application Ar

## Summary The forced password-change flow, triggered when the stored password is still the default (`admin`), does not verify that the password submitted by the client actually matches the current password. Any non-empty value in `pheditor_password` is enough to reach the password-change form, and submitting `pheditor_new_password` / `pheditor_confirm_password` in the same request is enough to s

SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data. Successful exploitation results in high impact on conf

SAP Commerce Cloud 存在一个高危漏洞，原因在于其保留了 SAP Help Portal 文档中公开的示例 OAuth2 客户端凭证。默认情况下，系统包含一个带有公开已知凭据的示例 OAuth2 客户端。如果管理员未在部署后删除或修改这些示例凭证，攻击者无需认证即可使用这些广为人知的凭据获取有效的访问令牌。凭借该令牌，攻击者可以调用某些 API 接口，从而读取或修改敏感数据。该漏洞对机密性和完整性造成严重影响，但不会影响系统可用性。CVSS 评分为 9.1 (Critical)。受影响版本为未明确指定的 SAP Commerce Cloud 版本（通常为默认配置包含该示例客户端的版本）。建议用户立即检查并删除所有示例 OAuth2 客户端配置，同时限制相关 API 的网络访问以降低风险。SAP 已发布安全补丁，强烈建议尽快应用。由于凭证公开且无需交互即可利用，该漏洞具有较高的被攻击风险，但截至分析时尚未有在野利用报告。

IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the application before the system enforces a credential update.

JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a hard-coded credentials vulnerability that allows network-adjacent attackers to gain unauthorized access by using the default admin username with an empty password accepted by the anyka_ipc HTTP service on port 80. Attackers can authenticate with these hardcoded credentials to access camera snapshots, video streams, netw

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERWRITE_ME as the default Rails master key. Combined with cookies_serializer = :marshal, this gives any logged-in user a deterministic Marshal-deserialization path reachable via the /my/two_factor_devices cookie reader This vulnerability is fix

Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain a Use of Default Credentials vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.

Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain a Use of Default Credentials vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.

Dell AIOps Collector versions prior to 1.18.3 contain a "Use of Default Credentials" vulnerability. A low privileged attacker with console access could potentially exploit this vulnerability to gain Filesystem access. This vulnerability only affects fresh installations of Collector versions earlier than 1.18.3. Systems that have been upgraded (either manually or automatically) to version 1.18.3 or

Brickcom cameras ship with default credentials that allows any unauthenticated remote attacker to silently access camera feeds.

Brickcom cameras ship with default credentials that allows any unauthenticated remote attacker to silently access camera feeds.

Use of default credentials vulnerability in Roche Diagnostics navify Digital Pathology (RabbitMQ Management interface modules) allows Default Usernames and Passwords. This issue affects navify Digital Pathology: from 2.0.0 before 2.4.1.

Use of default credentials vulnerability in Roche Diagnostics navify Digital Pathology (RabbitMQ Management interface modules) allows Default Usernames and Passwords. This issue affects navify Digital Pathology: from 2.0.0 before 2.4.1.

The Danelec MacGregor Voyage Data Recorder device includes a default username and password, with no enforced password change.

The Danelec MacGregor Voyage Data Recorder device includes a default username and password, with no enforced password change.

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the internode RPC layer authenticates every request with an HMAC-SHA256 signature using a shared secret. The function that produces this secret, get_shared_secret() in crates/ecstore/src/rpc/http_auth.rs, falls back to the public, source-tree-embedded DEFAULT_SECRET_KEY = "rustfsadmin" when neither the RUSTFS_RPC_S

IBM Operations Analytics - Log Analysis  and IBM SmartCloud Analytics - Log Analysis uses default passwords default passwords from the manufacturing process for use during the installation process, which could allow an attacker to bypass authentication.

IBM Cloud Pak for Data System - Cyclops 11.3.0.2 through Interim Fix 002 IBM Cloud Pak for Data System uses default passwords default passwords from the manufacturing process for use during the installation process, which could allow an attacker to bypass authentication.

Tyler Identity Local (TID-L) uses documented, default administrative credentials. Users are not required to change the credentials before deployment. TID-L has not been distributed since December 2020, and has not been supported since 2021.

Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and writes. Prior to version 1.0.42-hotfix, the --address CLI flag (and NORNICDB_ADDRESS / server.host config key) is plumbed through to the HTTP server correctly but never reaches the Bolt server config. The Bolt listener therefore always binds to the wildcard address (all interfaces),