The vulnerability is a hard‑coded default admin account named admin with password Databuff@123. An unauthenticated attacker can POST these credentials to the login API to receive an admin token and then call any protected endpoint. This effectively bypasses authentication and grants full administrative privileges, allowing configuration changes, data export, or any privileged operation.

Affected systems are Databuff AI‑PM Web deployments of databufflabs:databuff, specifically version 0.1.10 and earlier. The problem exists in the component located in PortalUserManagementService.java. Any instance running this code without changing the default credentials is vulnerable.

The CVSS score of 9.3 indicates a severe risk. While EPSS data is not available, the lack of a KEV listing does not reduce the urgency. An attacker only needs network access to the web API and can supply the known credentials; no code execution or privilege escalation beyond obtaining an admin token is required. Therefore the attack vector is remote, authenticated through the public API, and highly exploitable.