Eclipse OpenMQ Default Password Vulnerability in Administrative Account

A vulnerability exists in Eclipse OpenMQ's TCP-based management service (imqbrokerd), which requires authentication but is shipped with a default administrative account (admin/admin) and no mandatory password change on first use. After the initial login, the default password is accepted indefinitely, creating a risk for remote attackers with access to the service port to authenticate as administrators and gain full control over the administrative features. This vulnerability affects all versions of OpenMQ.

Impact

Exploitation of this vulnerability allows remote authentication as an administrator, granting full control over the protocol's administrative features. This also enables the exploitation of other authenticated-only vulnerabilities within the same protocol surface.