{"record":{"id":"fa5ab514992674b6","repo":"SonarSource/sonarqube","slug":"error-fa5ab5","errorCode":null,"errorMessage":"####################################################################################################################","messagePattern":"####################################################################################################################","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"server/sonar-webserver-auth/src/main/java/org/sonar/server/authentication/DefaultAdminCredentialsVerifierImpl.java","lineNumber":84,"sourceCode":"    try (DbSession session = dbClient.openSession(false)) {\n      UserDto admin = getAdminUser(session);\n      if (admin == null) {\n        return false;\n      } else {\n        return isDefaultCredentialUser(session, admin);\n      }\n    }\n  }\n\n  private UserDto getAdminUser(DbSession session) {\n    return dbClient.userDao().selectActiveUserByLogin(session, \"admin\");\n  }\n\n  private static void addWarningInSonarDotLog() {\n    String highlighter = \"####################################################################################################################\";\n    String msg = \"Default Administrator credentials are still being used. Make sure to change the password or deactivate the account.\";\n\n    LOGGER.warn(highlighter);\n    LOGGER.warn(msg);\n    LOGGER.warn(highlighter);\n  }\n\n  private boolean isDefaultCredentialUser(DbSession dbSession, UserDto user) {\n    try {\n      localAuthentication.authenticate(dbSession, user, \"admin\", AuthenticationEvent.Method.BASIC);\n      return true;\n    } catch (AuthenticationException ex) {\n      return false;\n    }\n  }\n\n  private void sendEmailToAdmins(DbSession session) {\n    if (dbClient.internalPropertiesDao().selectByKey(session, DEFAULT_ADMIN_CREDENTIAL_USAGE_EMAIL)\n      .map(Boolean::parseBoolean)\n      .orElse(false)) {\n      return;","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-auth/src/main/java/org/sonar/server/authentication/DefaultAdminCredentialsVerifierImpl.java#L66-L102","documentation":"DefaultAdminCredentialsVerifierImpl logs a highlighted warning banner when the default administrator credentials (admin/admin) are still valid on the running SonarQube instance. It is a security warning telling the administrator to change the default password or deactivate the default account.","triggerScenarios":"At server startup runAtStart() checks whether the default admin account still authenticates with password \"admin\" (via localAuthentication.authenticate); if successful, addWarningInSonarDotLog() emits the highlighted warning lines.","commonSituations":"Fresh SonarQube installations that were never hardened; demo/test instances promoted to production without changing the default admin password.","solutions":["Log in as admin and change the default password immediately (My Account > Security, or Administration).","Deactivate the default admin account if unused and use a dedicated admin user.","Re-run the instance behind proper access controls until credentials are changed; the warning disappears once the default password no longer authenticates."],"exampleFix":"// no code change; operational fix\n// after\nAdministration > Security > change 'admin' password from 'admin' to a strong value","handlingStrategy":"validation","validationCode":"// verify default credentials are disabled before promoting an instance\ncurl -u admin:admin -o /dev/null -w '%{http_code}' http://localhost:9000/api/authentication/validate\n# 200 means default admin/admin still works — change it","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Change the default admin password as part of installation runbooks","Automate a post-install credential rotation step","Deactivate the built-in admin account and use named admin users"],"tags":["sonarqube","security","default-credentials","authentication"],"backgroundTag":"authentication-required","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}