{"record":{"id":"0efdee1c5aba0cda","repo":"SonarSource/sonarqube","slug":"default-administrator-credentials-are-still-being","errorCode":null,"errorMessage":"Default Administrator credentials are still being used. Make sure to change the password or deactivate the account.","messagePattern":"Default Administrator credentials are still being used\\. Make sure to change the password or deactivate the account\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"server/sonar-webserver-auth/src/main/java/org/sonar/server/authentication/DefaultAdminCredentialsVerifierImpl.java","lineNumber":85,"sourceCode":"      UserDto admin = getAdminUser(session);\n      if (admin == null) {\n        return false;\n      } else {\n        return isDefaultCredentialUser(session, admin);\n      }\n    }\n  }\n\n  private UserDto getAdminUser(DbSession session) {\n    return dbClient.userDao().selectActiveUserByLogin(session, \"admin\");\n  }\n\n  private static void addWarningInSonarDotLog() {\n    String highlighter = \"####################################################################################################################\";\n    String msg = \"Default Administrator credentials are still being used. Make sure to change the password or deactivate the account.\";\n\n    LOGGER.warn(highlighter);\n    LOGGER.warn(msg);\n    LOGGER.warn(highlighter);\n  }\n\n  private boolean isDefaultCredentialUser(DbSession dbSession, UserDto user) {\n    try {\n      localAuthentication.authenticate(dbSession, user, \"admin\", AuthenticationEvent.Method.BASIC);\n      return true;\n    } catch (AuthenticationException ex) {\n      return false;\n    }\n  }\n\n  private void sendEmailToAdmins(DbSession session) {\n    if (dbClient.internalPropertiesDao().selectByKey(session, DEFAULT_ADMIN_CREDENTIAL_USAGE_EMAIL)\n      .map(Boolean::parseBoolean)\n      .orElse(false)) {\n      return;\n    }","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-auth/src/main/java/org/sonar/server/authentication/DefaultAdminCredentialsVerifierImpl.java#L67-L103","documentation":"This is the human-readable security message of the same banner from DefaultAdminCredentialsVerifierImpl.addWarningInSonarDotLog: default administrator credentials are still in use and must be changed or the account deactivated.","triggerScenarios":"runAtStart() -> isDefaultCredentialUser() successfully authenticates the default admin user with password \"admin\" using localAuthentication.authenticate(dbSession, user, \"admin\", BASIC), triggering the warning message.","commonSituations":"Unchanged default password after first install; scripted deployments that never set SONAR_WEB_SYSTEMPASSCODE or rotate the admin password.","solutions":["Change the admin password to a strong value via the UI or the web API (api/users/change_password).","Deactivate the built-in admin account if a dedicated administrator account exists.","Confirm the warning is gone on next startup/re-check."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// check whether default creds authenticate; if they do, rotate immediately\nstatus=$(curl -s -u admin:admin -o /dev/null -w '%{http_code}' $SONAR_URL/api/authentication/validate)\n[ \"$status\" = \"401\" ] || echo \"ALERT: default admin credentials active\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Include credential rotation in deployment scripts (api/users/change_password)","Scan environments for default admin/admin access regularly","Restrict network access to the SonarQube port until hardened"],"tags":["sonarqube","security","default-credentials","authentication"],"backgroundTag":"authentication-required","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}