CVE-2026-25803: 3DP-MANAGER Uses Hard-coded Credentials

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-06 · updated 2026-06-17
Weakness: CWE-798

Description

3DP-MANAGER is an inbound generator for 3x-ui. In version 2.0.1 and prior, the application automatically creates an administrative account with known default credentials (admin/admin) upon the first initialization. Attackers with network access to the application's login interface can gain full administrative control, managing VPN tunnels and system settings. This issue will be patched in version 2.0.2.

Affected products

denpiligrim 3dp-manager: through 2.0.1

References

https://github.com/denpiligrim/3dp-manager/commit/f568de41de97dd1b70a963708a1ee18e52b9d248
https://github.com/denpiligrim/3dp-manager/security/advisories/GHSA-5x57-h7cw-9jmw

Get alerted when CVE-2026-25803 or the next vulnerability affects your stack