CVE-2025-51536

The vulnerability consists of a hardcoded password for the administrator account in the OpenAtlas application, which is a classic example of CWE-798 (Use of Hard-coded Credentials) and CWE-1392 (Use of Default Credentials). An attacker who discovers or guesses this password (e.g., through source code or documentation analysis) can log into the administrator account without any additional authentication barriers. The attack vector is network-based and does not require prior authentication or user interaction.

An attacker gains full access to the application's administrator account, resulting in a breach of confidentiality, integrity, and availability of data — including the possibility of theft, modification, or deletion of archaeological data stored in the system.

Apply patches available from the manufacturer according to the references. As an immediate remedial action, change the administrator account password to a unique and strong password and restrict access to the administration panel exclusively to trusted IP addresses.

OpenAtlas v8.11.0 (Austrian Archaeological Institute)