CVE-2026-119662

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via the /api/v1/auth/login endpoint to modify library and configuration...

CVE-2026-119662 Songloft 2.9.0 before 2.13.6 Hardcoded Admin Credentials in Embedded Backend

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via the /api/v1/auth/login endpoint to modify library and configuration...

CVE-2026-119662

Versions of Songloft from 2.9.0 before 2.13.6 are vulnerable to a hardcoded credentials vulnerability in the embedded backend. Attackers located on the same network can authenticate as an administrator by using the fixed admin/admin pair via the /api/v1/auth/login endpoint. Successful authenticat...

CVE-2026-119662 Songloft 2.9.0 before 2.13.6 Hardcoded Admin Credentials in Embedded Backend

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via the /api/v1/auth/login endpoint to modify library and configuration...

EUVD-2026-114078

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via the /api/v1/auth/login endpoint to modify library and configuration...

CVE-2026-119662: songloft-org songloft: Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to…

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via the /api/v1/auth/login endpoint to modify library and configuration...

PT-2026-133592

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via the /api/v1/auth/login endpoint to modify library and configuration...

CVE-2026-111693

DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator...

CVE-2026-111693

The DataBuff ai-apm-web application (versions through 0.1.10 ) is vulnerable to a hard-coded default credentials vulnerability (CWE-1392 ). Unauthenticated attackers can gain administrator access by sending a POST request with the built-in account admin/Databuff@123 to the /webapi/api/v1/auth/log...

CVE-2026-111693 DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials

DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator...

EUVD-2026-102984

DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator...

CVE-2026-111693 DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials

DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator...

CVE-2026-111693 DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials

DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator...

CVE-2026-111693: Use of Default Credentials

DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator...

PT-2026-116092

🚨 CVE-2026-111693 DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtai...