Key points
- CVE-2026-112296 carries a CVSS score of 9.3, rated Critical.
- Attackers use the default username 'flycms' and password 'admin123'.
- The flaw affects versions up to commit edfdf724c3b944310f60c29aa755d03a00a75837.
Remote attackers can now seize complete administrative control of FlyCms installations without prior authentication. By exploiting a default credentials vulnerability, malicious actors gain super administrator privileges across site content, user management and configuration settings. This access is achieved through the standard login endpoint, bypassing security measures that would normally restrict entry. The National Vulnerability Database records this issue as CVE-2026-112296, highlighting the severe risk posed by unchanged default authentication parameters in web applications.
In plain English
The software contains a pre-set username and password that remains active unless manually changed. Attackers do not need to steal valid credentials or exploit complex coding errors. Instead, they use the known default account 'flycms' with the password 'admin123'. This allows immediate entry into the system's administrative interface, granting the same powerful controls as the site owner. The barrier to entry is minimal, requiring only the ability to solve a basic image-based captcha verification.
The background
The vulnerability affects FlyCms developed by sunkaifei, specifically in versions up to commit edfdf724c3b944310f60c29aa755d03a00a75837. The flaw is classified under CWE-1392, indicating improper handling of default credentials. Attackers target the POST /api/auth/login endpoint to submit these default details. Solving the image captcha is the only additional requirement for successful login. Once authenticated, attackers obtain full control over site content, user accounts and system configuration without triggering standard authentication warnings.
What changes now
Organisations using affected FlyCms versions must immediately verify their authentication settings. Default credentials should never remain active in production environments. Administrators should audit login logs for unauthorised access attempts using the known default account. The vendor has not confirmed a patch or update for this specific vulnerability. Users should consider isolating affected systems until a secure configuration is implemented or a software update becomes available.
The attacker's path
Teams usually encounter this class of vulnerability when deploying software with unchanged default settings. Check whether your deployment process includes automated credential rotation. This stage of an intrusion serves initial access, allowing attackers to bypass authentication entirely. Monitor for successful logins from unfamiliar IP addresses using default accounts. Ensure that administrative endpoints are not publicly accessible without additional verification layers. Implement alerts for any login attempts using known default credentials.
What to do and how to stay safe: FlyCms
- Change all default usernames and passwords immediately upon deployment.
- Monitor authentication logs for attempts using known default credentials.
- Restrict administrative login endpoints to trusted IP addresses only.
- Verify that no hardcoded credentials remain in configuration files.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-112296?
The vulnerability has a CVSS score of 9.3, rated as Critical.
Which FlyCms versions are affected by this flaw?
Versions up to commit edfdf724c3b944310f60c29aa755d03a00a75837 are affected.
How do attackers exploit this vulnerability?
Attackers use the default username 'flycms' and password 'admin123' via the login endpoint.
