CVE-2026-125384: INDOTALENT WHMS before 10.20261109 Default Administrator Credentials via UserAdminSeeder
INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates admin@root.com with password 123456. Attackers can log in with these credentials, which carry every admin role and no forced password change, to fully control deployments that kept them.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments of INDOTALENT WHMS before 10.20261109 are exposed if they retained the administrator account created by UserAdminSeeder with its default credentials.
What does an attacker need to exploit the vulnerability?
An attacker only needs network access to the application login interface. No existing account, privileges, or user interaction is required.
What access is obtained after successful login?
The default admin@root.com account is assigned every administrator role and is not subject to a forced password change. An attacker who logs in can fully control the affected deployment.
How can administrators determine whether they are affected?
Check whether the deployment is running a version before 10.20261109 and whether an admin@root.com account seeded with the default password remains usable. A successful login using those credentials indicates the deployment is affected.