CVE-2026-25803

Description

3DP-MANAGER is an inbound generator for 3x-ui. In version 2.0.1 and prior, the application automatically creates an administrative account with known default credentials (admin/admin) upon the first initialization. Attackers with network access to the application's login interface can gain full administrative control, managing VPN tunnels and system settings. This issue will be patched in version 2.0.2.

PUBLISHED Reserved 2026-02-05 | Published 2026-02-06 | Updated 2026-02-09 | Assigner GitHub_M

Problem types

CWE-798: Use of Hard-coded Credentials

Product status

References

github.com/...anager/security/advisories/GHSA-5x57-h7cw-9jmw

github.com/...ommit/f568de41de97dd1b70a963708a1ee18e52b9d248

cve.org (CVE-2026-25803)

nvd.nist.gov (CVE-2026-25803)

Download JSON