What is CVE-2026-25803?

CVE-2026-25803 is a critical-severity vulnerability in Denpiligrim 3dp-Manager, classified under Use of Hard-coded Credentials. CVSS score: 9.8/10. Published 2026-02-06.

How severe is CVE-2026-25803?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Denpiligrim 3dp-Manager

CVE-2026-25803

3DP-MANAGER is an inbound generator for 3x-ui. In version 2.0.1 and prior, the application automatically creates an administrative account with known default credentials (admin/admin) upon the first initialization. Attackers with network access to the application's login interface can gain full administrative control, managing VPN tunnels and system settings. This issue will be patched in version 2.0.2.

EPSS: 0.004 (29.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Denpiligrim 3dp-manager — versions <= 2.0.1

Weakness classification (CWE)

CWE-798 — Use of Hard-coded Credentials

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2026-25803?: CVE-2026-25803 is a critical-severity vulnerability in Denpiligrim 3dp-Manager, classified under Use of Hard-coded Credentials. CVSS score: 9.8/10. Published 2026-02-06.
How severe is CVE-2026-25803?: Critical severity. CVSS v3 base score is 9.8 out of 10.