Executive brief
newbee-mall, an e-commerce platform, contains pre-configured administrator accounts with a well-known default password in its setup scripts. If a business deploys this software without manually changing these credentials, an attacker can easily log in with full administrative privileges. This could lead to the theft of customer data, modification of orders, or a total shutdown of the online store.
Technical details
The vulnerability is a case of hard-coded/use of default credentials (CWE-798) within the `newbee_mall_schema.sql` initialization script. The script seeds three administrative accounts ('admin', 'newbee-admin1', and 'newbee-admin2') with the MD5 hash 'e10adc3949ba59abbe56e057f20f883e', which corresponds to the predictable password '123456'. An unauthenticated remote attacker can exploit this by accessing the administrative login interface and using these default credentials if they were not changed post-deployment. Additionally, the application uses unsalted MD5 hashing for all passwords, making any leaked credentials highly susceptible to offline brute-force attacks.
Affected products
- newbee-ltd newbee-mall <= 1.0.0
Timeline
- 2026-02-12: disclosed: Issue reported on GitHub and advisory published by VulnCheck
- 2026-02-12: advisory: NVD published CVE-2026-26218