CVE-2026-118458: AIS shared test login provider contains fixed administrative credentials

Published Nov 9, 2026

Updated

The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts.

Affected Software

1 affected component

AIS shared test login provider

Event History

Nov 9, 2026

CVE Published

via MITRE·11:46 AM

Data Sourced

via MITRE·11:46 AM

DescriptionWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments using the shared AIS login routing for the H or V application codes are affected because those routes select the production-shipped test DAO.

What does an attacker need to exploit this issue?

The issue is remotely exploitable with low attack complexity and requires no privileges or user interaction. Exploitation relies on the fixed administrator accounts accepted by the affected login provider.

Are confidentiality, integrity, and availability at risk?

Yes. The provided CVSS vector rates impacts to confidentiality, integrity, and availability as high.

CVE-2026-118458: AIS shared test login provider contains fixed administrative credentials

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

Are confidentiality, integrity, and availability at risk?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

Are confidentiality, integrity, and availability at risk?