CVE-2026-111693
Critical · 9.8CVSS
9.8
EPSS
0.5%
Published
Oct 16, 2026
CISA due date
—
The record
DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all protected /webapi routes.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-22109 The shipped WebUI template database retains the factory default passwords for all five… CWE-1392
- CVE-2026-22105 Delta UFC500 charging stations derive the default credentials of the Service account from… CWE-1392
- CVE-2026-19741 Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default… CWE-1392
- CVE-2026-55457 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-1392
- CVE-2026-112296 FlyCms through commit edfdf724 contains a default credentials vulnerability that allows… CWE-1392
- CVE-2026-86464 In the current development version of Eclipse aeriOS, for which no official release has… CWE-1392
- CVE-2026-65313 A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering… CWE-1392
- CVE-2026-68503 LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. CWE-1392