CVE-2026-41930: Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosure via phpMyAdmin
Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attackers to access the bundled phpMyAdmin container with pre-configured database credentials. Attackers can connect to the phpMyAdmin port to gain unrestricted read and write access to the entire Vvveb database, including administrator password hashes, customer personally identifiable information, and order data, enabling account takeover and data manipulation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vvvebto a version that resolves this vulnerability.Fixed in 1.0.8.2 - Configuration
Edit Vvveb's docker-compose-apache.yaml to eliminate the hard-coded credentials vulnerability that allows unauthenticated access to the bundled phpMyAdmin container; ensure phpMyAdmin is not reachable with pre-configured hard-coded database credentials.
Vvveb docker-compose-apache.yaml phpMyAdmin bundled credentials (hard-coded pre-configured database credentials) = remove hard-coded credentials / ensure phpMyAdmin does not use pre-configured hard-coded credentials
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41930?
CVE-2026-41930 is classified as a high severity vulnerability due to the potential for unauthorized access to sensitive information.
How do I fix CVE-2026-41930?
To fix CVE-2026-41930, update to Vvveb version 1.0.8.2 or later to eliminate the hard-coded credentials vulnerability.
What type of vulnerability is CVE-2026-41930?
CVE-2026-41930 is a hard-coded credentials vulnerability that allows unauthenticated access to the phpMyAdmin container.
Who is affected by CVE-2026-41930?
CVE-2026-41930 affects all versions of Vvveb prior to 1.0.8.2.
What component of Vvveb is affected in CVE-2026-41930?
CVE-2026-41930 affects the docker-compose-apache.yaml configuration file of Vvveb.