# Default Credentials Leading to Administrative Access and Sensitive Data Exposure in MinIO UAT Environment
The affected asset is redacted at the researcher's request.
I discovered a MinIO instance belonging to A.S. Watson Group's UAT environment that was accessible using default credentials:
Access Key: admin Secret Key: admin1234
These credentials provided administrative access to the MinIO management interface without requiring any additional authentication or authorization.
The affected instance was accessible at:
https://uat-mpimage.app.aswatson.com/
The MinIO browser was additionally exposed through:
https://uat-mpimage.app.aswatson.com/minio/adobe/
After authenticating with the default credentials, I was able to access the administrative interface and interact with the storage environment.
During further investigation, I discovered approximately 200 GB of files and subsequently identified an exposed config.properties file containing database-related information and SMTP configuration details.