Tyler Identity Local (TID‑L) ships with documented default administrative credentials that users are not required to change before deployment. This flaw allows an attacker who knows or discovers the default username and password to obtain full administrative control of the system, potentially compromising confidentiality, integrity, and availability of the data and services managed by TID‑L. The weakness is a classic example of weeding out hardcoded defaults and is cataloged as CWE‑1392.

The affected product is Tyler Technologies’ Tyler Identity Local (TID‑L). No specific version numbers are published; it has not been distributed since December 2020 and is no longer supported as of 2021.

The likely attack vector is local or remote deployment access, because the credentials are documented and remain unchanged after installation. With a CVSS score of 9.3 the vulnerability is rated Very High. The EPSS score is not available, and it is not currently listed in CISA’s KEV catalog. Nevertheless, any new or existing deployment of TID‑L carries a high risk of an attacker gaining full administrative privileges by simply using the documented default credentials.