FlyCms through commit edfdf724 exposes an unauthenticated remote access vulnerability by including a default super administrator account with the username flycms and password admin123. Attackers can log in via POST /api/auth/login after solving an image captcha, enabling full control over the site, including content, user accounts, and system configuration.

The affected product is FlyCms, specifically the release identified by the commit hash edfdf724, produced by the vendor sunkaifei. Any deployment that has not removed or altered this default account or updated to a newer commit is at risk.

The vulnerability has a CVSS score of 9.3, indicating a high impact and ease of exploitation. Because EPSS is not available and the issue is not listed in KEV, the probability of widespread exploitation is unknown, but the attack vector is straightforward: an unauthenticated attacker can obtain super‑administrator privileges by leveraging the default credentials. The potential for confidentiality, integrity, and availability compromise is therefore significant.