# Default credentials on admin surface

Shipped or placeholder passwords, alternate auth endpoints, and admin panels still reachable

_Area: Web authentication and account takeover. Seen in 3 disclosed reports; one confirmed bounty: $7,000; latest 2024-01-31. Updated 2026-10-23._

## How it works
A product ships a credential it knows (a default admin password, a fixed Basic auth pair, a placeholder password for provisioned users) and assumes the operator changes it or that the surface stays unreachable. The assumption breaks when the endpoint remains enabled, is exposed, or when a second auth path still accepts the same value. Anyone who knows the shipped value logs in as a privileged or provisioned user without guessing.

## Where it shows up
- Literal credentials in product config, installers, or plugin code [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-apple.md)[E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-advisory-solarwinds-web-help-desk-arbitrary-hql-evaluation-cve-2021-35232.md)
- SSO/provisioning plugins that create users with a fixed placeholder password [E2](https://bugbountylibrary.com/r/h1%3A138869.md)
- Alternate auth entry points left open when one is blocked: XMLRPC, REST, query-string login variants [E2](https://bugbountylibrary.com/r/h1%3A138869.md)
- Endpoints that accept raw query language or admin actions with no authorization check behind the default credential [E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-advisory-solarwinds-web-help-desk-arbitrary-hql-evaluation-cve-2021-35232.md)
- Hidden default passwords reused across registrations [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-apple.md)

## How to review
Grep configs, installers, and plugin source for literal credentials and placeholder passwords, then test each auth entry point independently. The invariant: no shipped or placeholder credential may authenticate to any reachable surface, and blocking one auth path must not leave another accepting the same credential. For SSO plugins, confirm provisioned users cannot log in via any native path (XMLRPC, REST) with the placeholder [E2](https://bugbountylibrary.com/r/h1%3A138869.md). Check that admin routes are gated by authorization, not just a filter that path tricks can bypass [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-apple.md).

Compounding weaknesses (not default creds themselves, but they widen the blast radius): path tricks reaching admin routes past a filter, e.g. `/admin;/` [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-apple.md); endpoints passing request bodies to raw query evaluation without authorization [E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-advisory-solarwinds-web-help-desk-arbitrary-hql-evaluation-cve-2021-35232.md).

## Variants seen
- Hidden default password plus path-bypass to admin [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-apple.md)
- SSO plugin placeholder password reachable via XMLRPC [E2](https://bugbountylibrary.com/r/h1%3A138869.md)
- Hardcoded Basic auth bypassing auth to a raw-query endpoint [E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-advisory-solarwinds-web-help-desk-arbitrary-hql-evaluation-cve-2021-35232.md)

## Impact and severity
Led to full admin access, user minting, and data exposure (password hashes, DB writes) [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-apple.md)[E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-advisory-solarwinds-web-help-desk-arbitrary-hql-evaluation-cve-2021-35232.md); account takeover and content upload via SSO users [E2](https://bugbountylibrary.com/r/h1%3A138869.md). Severity rises with internet exposure, missing MFA, and privileged blast radius.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-apple.md
- E2: https://bugbountylibrary.com/r/h1%3A138869.md
- E3: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-advisory-solarwinds-web-help-desk-arbitrary-hql-evaluation-cve-2021-35232.md