CVE-2026-16504

The vulnerability arises from the deployment of the VPS.org one-click Zulip template, which includes a hardcoded application signing key, a default database password of "zulip," and disables HTTPS by default. This configuration significantly increases the risk of unauthorized access and data breaches, as sensitive information can be easily exploited by attackers. Organizations utilizing this deployment should prioritize immediate remediation to secure their Zulip instances and protect against potential exploitation.