Eclipse OpenMQ exposes a TCP‑based management service that requires authentication. The package ships with a default administrative account, username and password both set to 'admin', and the system does not enforce a mandatory password change on first use. After a successful login, the server continues to accept these default credentials indefinitely, giving an attacker who can reach the service port a persistent administrative session and full control of the management protocol.

The vulnerability affects Eclipse OpenMQ, as defined by its CNA. No specific version range is listed; it applies to all currently shipped versions that include the imqbrokerd management service with the default admin account left enabled without a forced password change.

The CVSS base score is 9.8, indicating critical severity. The EPSS score is less than 1%, implying that exploitation has been rare to date, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the attack vector is remote and network‑based; an attacker with access to the management service port can authenticate with the default credentials and perform any administrative task defined by the protocol, including user management, configuration changes, and data exposure. Because the default account remains valid indefinitely, the opportunity for exploitation remains broad as long as the service is left enabled without credential changes.