INDOTALENT WHMS versions prior to 10.20261109 have a default credentials vulnerability. The software creates a default administrator account with the email admin@root.com and password 123456, which is not forced to be changed. This allows unauthenticated attackers to log in with full administrative privileges and control over deployments.