Can flycms:admin123 credentials grant full site control?

Security researchers have identified a critical authentication bypass in FlyCms that allows remote attackers to seize super administrator privileges without prior authorization. The vulnerability exists in software versions up to commit edfdf724. According to the National Vulnerability Database, the flaw is classified as CVSS 9.3 Critical. This high severity rating reflects the ease of exploitation and the extensive access granted to an attacker who successfully logs in using the exposed default credentials.

By the numbers

• CVSS 9.3: The base score assigned to CVE-2026-112296, indicating a critical severity level for this authentication failure.
• CWE-1392: The weakness classification for the use of default credentials that remain active in the deployed software.
• One: The number of image captcha solutions required by an attacker to complete the login process via the API endpoint.

What the figures mean

The CVSS score of 9.3 highlights the immediate risk posed by this vulnerability. Because the flaw allows unauthenticated remote access, an attacker does not need to be inside the network to exploit it. The source material states that attackers can log in by solving only the image captcha. Once the attacker submits the hardcoded username flycms and password admin123 to the POST /api/auth/login endpoint, they gain super administrator access. This level of control allows them to modify site content, manage user accounts, and alter system configuration settings.

What to watch

Teams monitoring for this threat should look for unusual login activity on the /api/auth/login endpoint, particularly from unknown IP addresses. Since the exploit relies on default credentials, any successful authentication using the flycms account is a strong indicator of compromise. Analysts should also monitor for subsequent administrative actions, such as the creation of new user accounts or changes to system configuration files. These actions often follow the initial breach and can signal that an attacker is establishing persistence or exfiltrating data.

Infection and persistence in general

Default credential vulnerabilities typically arrive when software is deployed without changing factory-set usernames and passwords. Attackers use automated scanners to identify exposed login pages and test common default combinations. Once access is gained, they often create new administrative accounts to ensure persistence even if the default password is later changed.

They may also install web shells or modify application code to maintain backdoor access. Analysts usually examine authentication logs for failed and successful login attempts from multiple sources. They also check for new user accounts or unexpected changes to configuration files that indicate unauthorized administrative activity.

What to do and how to stay safe: FlyCms

• Change the default username and password for the flycms account immediately if you are using an affected version.
• Monitor authentication logs for login attempts using the default credentials or from unfamiliar IP addresses.
• Restrict access to the /api/auth/login endpoint to trusted IP ranges if possible to reduce exposure.
• Verify that no new administrative accounts have been created recently to detect potential persistence mechanisms.

Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan

General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for this FlyCms vulnerability?

The vulnerability is tracked as CVE-2026-112296.

Which versions of FlyCms are affected by this flaw?

All versions of FlyCms up to and including commit edfdf724c3b944310f60c29aa755d03a00a75837 are affected.

How can an attacker exploit this vulnerability?

An attacker can exploit this by logging in via POST /api/auth/login using the username flycms and password admin123, after solving an image captcha.