Default Credentials Vulnerability in FlyCms (CVE-2026-112296)

FlyCms versions through commit edfdf724 contain a critical default credentials vulnerability. An unauthenticated remote attacker can exploit this flaw by leveraging the default username 'flycms' and password 'admin123'. By sending a POST request to the application's authentication endpoint and successfully solving the required image captcha, an attacker can authenticate as a super administrator. This grants the attacker full control over the application's content, user management, and system configuration. Given the ease of exploitation and the level of access granted, organizations running affected versions of FlyCms are at high risk of unauthorized site takeover.

Impact

Successful exploitation results in full administrative control over the FlyCms instance. This allows attackers to modify site content, manipulate user accounts, and alter system configurations, potentially leading to persistent unauthorized access, data exfiltration, or further compromise of the underlying hosting environment.

Recommendation

• Immediately audit all FlyCms instances to identify and update any installations running code versions at or prior to commit edfdf724.
• Implement a policy to change default vendor credentials upon initial deployment for all web-based content management systems.
• Monitor web server access logs for anomalous POST requests to /api/auth/login that originate from unexpected or external IP addresses.
• Restrict access to administrative login endpoints to trusted IP ranges or VPN-only access to prevent public exploitation attempts.