Is CVE-2026-90498 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90498 being exploited in the wild.

How severe is CVE-2026-90498?

High severity, with a CVSS score of 7.3, published 13 September 2026.

Is there a fix for CVE-2026-90498?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90498 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-90498?

Check whether you run Lenve Vhr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90498: lenve vhr default credentials in seed data

CVE-2026-90498 · Severity: high · CVSS 7.3 · Published 2026-09-13

vhr (微人事) is a human resources management system that ships with hardcoded default administrator credentials in its database initialization script. Attackers can immediately gain full administrative access to the system without authentication, allowing them to read sensitive employee and payroll data, modify HR records, or perform other administrative actions depending on system capabilities.

Technologies: Lenve Vhr. Vendors: Lenve.

Quick answers

Is CVE-2026-90498 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90498 being exploited in the wild.
How severe is CVE-2026-90498?: High severity, with a CVSS score of 7.3, published 13 September 2026.
Which products and versions are affected?: Lenve Vhr 1.0-SNAPSHOT.
Is there a fix for CVE-2026-90498?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90498 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-90498?: Check whether you run Lenve Vhr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a use-of-default-credentials issue (CWE-1392) in the vhr.sql seed data file. The database initialization script contains INSERT statements that set admin account passwords to "123" with BCrypt hashing, and the application does not force a password change on first login. An unauthenticated remote attacker can directly log in with username "admin" and password "123" via the /doLogin endpoint, gaining full administrative access. The vulnerability affects vhr 1.0-SNAPSHOT and is publicly exploitable; no patch or vendor response has been reported.

Affected products

lenve vhr 1.0-SNAPSHOT

Timeline

2026-09-13: disclosed
other: Exploit is publicly available; vendor was contacted early but did not respond

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.