CVE-2026-125384

Name of the Vulnerable Software and Affected Versions INDOTALENT WHMS versions prior to 10.20261109

Description An issue exists where the UserAdminSeeder function creates a default administrator account with the username admin@root.com and password 123456. Unauthenticated attackers can use these credentials to gain full administrator access to deployments, as the account possesses all administrative roles and does not require a password change upon first login.

Recommendations Update INDOTALENT WHMS to version 10.20261109 or later.