FlyCms Default Credentials Vulnerability Grants Unauthenticated Admin Access

The National Vulnerability Database has assigned a Critical severity rating to CVE-2026-112296, a default credentials vulnerability affecting the FlyCms web content management system. This flaw allows unauthenticated remote attackers to gain super administrator access to affected installations without needing valid user accounts or prior authentication tokens.

According to the NVD record, the vulnerability stems from hardcoded default login credentials that remain active in the software. Attackers can exploit this weakness by submitting a POST request to the /api/auth/login endpoint. By providing the username flycms and the password admin123, along with a solution to the image captcha, an attacker can successfully authenticate and assume full control of the site.

Technical Context and Impact

The issue is classified under CWE-1392, which relates to the use of hard-coded credentials. The NVD rates the exploitability and impact of this flaw at a CVSS score of 9.3, placing it in the highest severity tier. Once authenticated, the attacker gains super administrator privileges, which typically include the ability to modify site content, manage user accounts, and alter system configuration settings.

This level of access allows for complete compromise of the web application’s integrity and confidentiality. An attacker could potentially inject malicious code, steal sensitive user data, or deface the website. The requirement to solve an image captcha provides a minimal barrier to automated exploitation, but it does not prevent determined adversaries from gaining entry.

Affected Versions

The vulnerability affects the FlyCms product developed by sunkaifei. According to the advisory, all versions of the software up to and including commit edfdf724c3b944310f60c29aa755d03a00a75837 are vulnerable. Any deployment running a version prior to this specific commit hash is considered at risk.

Organizations using FlyCms for their web presence should verify their current version against this commit identifier. If the installation has not been updated to a version beyond edfdf724, it remains susceptible to this unauthenticated remote takeover vector. The source material does not indicate that a patch or fix has been confirmed or released by the vendor yet.

What should you do?

Security teams should immediately audit their web servers to identify any installations of FlyCms. If the software is present, administrators should check the version or commit hash to determine if it falls within the affected range. Until a vendor update is available, restricting access to the login endpoint via IP whitelisting or a web application firewall can reduce exposure.