A vulnerability in Diem Project's dmDataLoad.php allows an attacker to manipulate input and trigger the use of a default password. This bypasses authentication controls, enabling unauthorized access to the application and potentially to sensitive data or administrative functions. The weakness is characterized by CWE‑1393, which reflects that a hard‑coded or easily guessable password is being employed.

Affected entities are the Diem software (diem‑project:diem) versions up to and including 5.1.3. The issue resides in an unknown code path within dmCorePlugin/lib/data/dmDataLoad.php. Systems running any of these versions without custom configuration changes may be vulnerable.

The CVSS score of 5.3 indicates medium severity, and no EPSS data is available. The vulnerability is not listed in CISA's KEV catalog, but the public exploit demonstrates that remote attackers can exploit it by sending crafted requests. The risk remains during any period when the default password is in effect, making timely remediation important.