INDOTALENT WHMS before version 10.20261109 creates a built-in administrator account with the password 123456, so any unauthenticated attacker who can reach a deployment that still has it can take full control.
What Is It
CVE-2026-125384 is a default credentials vulnerability (CWE-1392) in INDOTALENT WHMS. VulnCheck lists the affected product as go2ismail's Asp.Net-Core-Inventory-Order-Management-System. The application's UserAdminSeeder component automatically creates an administrator account, [email protected], with the password 123456.
This account has every admin role. The application does not make anyone change the password on first login. As a result, the account stays usable on any deployment where nobody changed or removed it.
Why It Matters
VulnCheck scores this CVE 9.8 (Critical) on CVSS v3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and 9.3 (Critical) on CVSS v4.0. The attack works over the network, is simple to carry out, and needs no privileges or user interaction. An attacker only has to log in with the published credentials to get administrator access to an affected deployment. That means high impact to confidentiality, integrity and availability.
The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and the supplied data does not confirm active exploitation. However, the credentials appear in the public source code, so anyone can find them.
What's Vulnerable
- Vendor/Product: go2ismail / Asp.Net-Core-Inventory-Order-Management-System (INDOTALENT WHMS)
- Affected versions: all versions before
10.20261109 - Condition: deployments that still have the seeded
[email protected]/123456account
The NVD record has Received status and does not yet list any CPE entries.
Patch Status
A fixed version is available: v10.20261109. The NVD record links to this release and to two related upstream commits. Operators should:
- Upgrade to v10.20261109 or later.
- Check whether
[email protected]still exists with the default password on any running deployment. Upgrading the code alone may not change an account that was already created.
Sources
- NVD – CVE-2026-125384
- VulnCheck Advisory – INDOTALENT WHMS Default Administrator Credentials via UserAdminSeeder
- GitHub – Project Repository
- GitHub – UserAdminSeeder.cs (v9.20250118)
- GitHub – Commit 65609b5
- GitHub – Commit ded7d8a
- GitHub – Issue #48
- GitHub – Release v10.20261109
- CISA KEV Catalog – no entry for this CVE