Default Credentials Vulnerability in INDOTALENT WHMS by Go2Ismail
CVE-2026-125384

9.3CRITICAL

Key Information:

Vendor

Go2ismail

Status
Asp.net-core-inventory-order-management-system
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125384?

INDOTALENT WHMS versions before 10.20261109 have a default credentials vulnerability that permits unauthenticated attackers to log in as an administrator without any prior authentication. This issue arises because the UserAdminSeeder component creates an admin user with the hardcoded email 'admin@root.com' and password '123456'. This allows malicious actors to gain complete control over deployments that have not addressed this vulnerability, as there is no enforced password change for the default credentials, leading to significant security concerns.

Affected Version(s)

Asp.Net-Core-Inventory-Order-Management-System 0 < 10.20261109

References

https://github.com/go2ismail/Asp.Net-Core-Inventory-Order...
issue-tracking
https://github.com/go2ismail/Asp.Net-Core-Inventory-Order...
product
https://github.com/go2ismail/Asp.Net-Core-Inventory-Order...
technical-description

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.