A critical authentication bypass vulnerability in Creacast Creabox Manager allows unauthenticated attackers to gain unauthorized administrative access to the platform.

The application contains a hardcoded authentication flaw where the system validates access if the username is set to creabox and the password begins with the string creacast. This vulnerability allows an unauthenticated attacker to bypass login requirements entirely.

Successful exploitation of this flaw grants an attacker full access to the Creabox Manager, which likely governs media streaming or broadcast infrastructure. Given the high CVSS score of 8.8, this poses a severe risk of data exfiltration, system manipulation, or complete service disruption. Unauthorized access to such management interfaces often leads to significant reputational damage and potential loss of operational control over broadcast environments.

Immediate Action: Contact Creacast support immediately to obtain the latest security patches or configuration hardening steps to disable the hardcoded credential check.

Proactive Monitoring: Review system access logs for any login attempts originating from the username creabox or unusual authentication patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized access attempts to the management interface and restrict access to the application via IP whitelisting.

Public Exploit Available: Yes, a published proof-of-concept exists as attributed to the research write-up referenced in the CVE record.

This vulnerability represents a significant security failure due to the presence of hardcoded credentials. Administrators must prioritize verifying their version status with the vendor and implementing immediate network-level restrictions to prevent unauthorized access until a formal patch is applied. Failure to address this flaw leaves the management interface entirely exposed to external compromise.