SZB-58aa9436f9
EUVD-2026-114078 reports hardcoded admin credentials in Songloft before 2.13.6
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- songloft
- Product
- Songloft
- First seen
Summary
The EU Vulnerability Database (EUVD) entry EUVD-2026-114078 describes hardcoded credentials in Songloft 2.9.0 before 2.13.6, scored 8.7/10 (CVSS v3.1). Per the listing, adjacent network attackers can log in as administrator with the fixed admin/admin pair.
If you use songloft
Upgrade Songloft to version 2.13.6 or later
Change the admin/admin credentials immediately if still in use
Restrict network access to the Songloft admin interface
What the sources say 1
· Mastodon: “Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair.” Source