CVE-2026-16504

CriticalCVSS 9.8

Published: 31/07/2026(UTC)Updated: 03/08/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

Deployment of the VPS.org one-click Zulip template includes a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True.

Risk Assessment

An attacker can exploit these default credentials and lack of HTTPS encryption to take over the admin account, steal data, or impersonate the application.

Recommendation

Immediately change the application signing key, database password, and enable HTTPS (set DISABLE_HTTPS=False) after deploying the template.

Original NVD description (English source)

Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True.