Hardcoded default credentials are silently created when the bin/solr auth enable command is run, giving any user that knows the preset usernames and passwords full administrative control of an Apache Solr cluster. This allows a remote attacker to modify configuration, access all indexes, and potentially exfiltrate data or disrupt service. The weakness is a form of insecure default configuration, identified by CWE‑1188 and CWE‑798.

Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 are affected. Clusters that never used the BasicAuth bootstrap tool or that replaced the template users with strong passwords after bootstrap are not vulnerable.

The CVSS score of 8.1 indicates high severity and the vulnerability can be triggered remotely via the public endpoint used for BasicAuth configuration. No EPSS score is reported and the issue is not listed in CISA's KEV catalog, yet the presence of well‐known default credentials means an attacker can exploit it with minimal effort if the cluster is exposed to the network. The likely attack vector is a remote network request that activates the basic authentication setup, allowing the attacker to gain administrative privileges.