An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials.