Newbee-Mall seeds a default administrator account during database initialization with a predictable password. If an installation leaves the provided credentials unchanged, an attacker who can reach the application can authenticate as the administrator without needing any further access privileges. This grants full administrative control over the application, including configuration, user management, and data access, and therefore classifies the vulnerability as an account takeover that can compromise confidentiality, integrity, and availability.

The vulnerable product is newbee-Mall offered by newbee‑Ltd. The CVE metadata lists the specific release v1.0.0 and also indicates that any revision of the product that uses the same database schema may be affected. Deployments that include the provided initialization script and do not change the seeded credentials pose the risk. No other vendor or product is affected.

The issue carries a CVSS score of 9.3, denoting critical severity. The EPSS score is reported as less than 1 %, suggesting minimal observed exploitation, but the vulnerability remains a high‑risk vector. It is not present in the CISA KEV catalog. An attacker can exercise the flaw by attempting a simple login with the known default username and password; no additional conditions or exploits are required. The attack is remote, requiring only network access to the authentication endpoint.