EIP-2026-101398

The exploit reveals a hardcoded backdoor administrative account ('admin' with password 'Mirage1234') in the Osprey Pump Controller 1.0.1, allowing unauthorized access to the web management interface. The vulnerability is confirmed by decompiled code from the Mirage_ValidateSessionCode.x binary, showing the hardcoded credentials.