FlyCms Default Credentials Vulnerability Grants Super Admin Access

A default credentials vulnerability in FlyCms through commit edfdf724 allows unauthenticated remote attackers to gain super administrator access.

Attackers can log in through POST /api/auth/login using the flycms account with password admin123, solving only the image captcha.

• Affected versions: FlyCms through commit edfdf724
• Precondition: only the image captcha must be solved
• Impact: full control of site content, users, and configuration