CVE-2026-26218 - Vulnerability Analysis

Overview

newbee-mall contains a broken authentication vulnerability caused by pre-seeded administrator accounts with predictable default passwords in the database initialization script, letting unauthenticated attackers gain full administrative control, exploit requires unchanged default credentials.

Severity & Score

Impact

Unauthenticated attackers can log in as administrators and gain full control of the application.

Mitigation

Change default administrative credentials immediately after deployment or update to a version that removes default accounts.

References

• https://github.com/newbee-ltd/newbee-mall/issues/119
• https://www.vulncheck.com/advisories/newbee-mall-default-seeded-administrator-credentials-allow-account-takeover

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 12, 2026

🔴 CVE-2026-26218 - Critical (9.8) newbee-mall includes pre-seeded administrator accounts in its database initialization script. These accounts are provisioned with a predictable default password. Deployments that initialize or reset the database using the provided schema and fail ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26218/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner