AstrBot up to version 4.16.0 contains a vulnerability involving hard-coded credentials in the Dashboard component, specifically in the file astrbot/dashboard/routes/auth.py. This flaw allows remote attackers to exploit the hard-coded password, potentially compromising confidentiality, integrity, and availability. The vulnerability has a high severity score of 7.3 and has been publicly disclosed. The vendor has not responded to the disclosure, and no patch or remediation guidance is currently available.