CVE-2026-125384 · Other
NO FIX YET · SEE WHAT TO DO
INDOTALENT WHMS before 10.20261109 seeds an admin account admin@root.com with the password 123456. An attacker who logs in with these default credentials gets every admin role and full control of the deployment.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any deployment of INDOTALENT WHMS older than 10.20261109 that kept the seeded admin@root.com account with its default password is exposed. Deployments that changed or removed that account, or run a patched version, are not affected by this default credential.
Not affected if account-removed, default-password-changed, patched-version
Who cares indotalent, self-hosted, whms
admin@root.com in the user table or admin user list.10.20261109; anything older is in scope.123456.10.20261109 or later, per the linked patch.INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates admin@root.com with password 123456. Attackers can log in with these credentials, which carry every admin role and no forced password change, to fully control deployments that kept them.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.