Default Admin Credentials in Production

What Is This Vulnerability?

Default credentials exist when applications, databases, or admin panels ship with factory-set usernames and passwords (like admin/admin or root/password) that are not changed before deployment to production. Attackers routinely test for these well-known credentials as one of the first steps in any attack, gaining instant administrative access.

Why It Happens

Development environments use simple credentials for convenience. When applications are deployed to production without a proper configuration checklist, these defaults remain. Docker images, database installations, and admin dashboards often come with preset passwords. Teams assume someone else will change them, or the credentials get baked into infrastructure-as-code templates.

Example Code

const adminConfig = {
  username: "admin",
  password: "admin123",
  database: {
    host: "localhost",
    user: "root",
    password: "password",
  },
};

app.post("/admin/login", (req, res) => {
  if (req.body.username === adminConfig.username &&
      req.body.password === adminConfig.password) {
    req.session.isAdmin = true;
    res.redirect("/admin/dashboard");
  } else {
    res.status(401).send("Invalid credentials");
  }
});

import bcrypt from "bcrypt";

app.post("/admin/login", async (req, res) => {
  const { username, password } = req.body;
  const admin = await db.query(
    "SELECT * FROM admins WHERE username = $1",
    [username]
  );

  if (!admin.rows[0]) return res.status(401).send("Invalid credentials");

  const valid = await bcrypt.compare(password, admin.rows[0].password_hash);
  if (!valid) return res.status(401).send("Invalid credentials");

  req.session.isAdmin = true;
  req.session.adminId = admin.rows[0].id;
  res.redirect("/admin/dashboard");
});

// Setup script forces password change on first login
// Database credentials come from environment variables

How Hackers Exploit It

Attackers maintain lists of default credentials for common software (databases, routers, CMS platforms, admin panels). Automated scanners like Hydra or custom scripts test these credentials against discovered services. Cloud-exposed databases with default passwords are typically compromised within hours of being deployed. Once in, attackers have full administrative control.

How to Fix It

Never hardcode credentials in source code. Use environment variables for all secrets and require them to be set before the application starts. Force password changes on first login for admin accounts. Implement account lockout after failed attempts. Use a secrets manager (like AWS Secrets Manager or Vault) for production credentials. Add deployment checks that reject default values.

Frequently Asked Questions