Vulnerability · Published Feb 6, 2026 · Assigned by GitHub_M

CVE-2026-258033DP-MANAGER Uses Hard-coded Credentials

Critical 9.8

In plain English

A critical-severity hard-coded credentials in 3dp-manager from denpiligrim. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.4%top 66.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

3DP-MANAGER is an inbound generator for 3x-ui. In version 2.0.1 and prior, the application automatically creates an administrative account with known default credentials (admin/admin) upon the first initialization. Attackers with network access to the application's login interface can gain full administrative control, managing VPN tunnels and system settings. This issue will be patched in version 2.0.2.

Affected products (as reported)

Vendor	Product	Versions
denpiligrim	3dp-manager	<= 2.0.1

Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/denpiligrim/3dp-manager/security/advisories/GHSA-5x57-h7cw-9jmw x_refsource_CONFIRM
https://github.com/denpiligrim/3dp-manager/commit/f568de41de97dd1b70a963708a1ee18e52b9d248 x_refsource_MISC