are webapps allowed to have a default user with a default password?

[Evgeni Golov <sargentd@die-welt.net>]

Hi *,

while working on a fix for opendb's RC/Security bug #504173, I noticed
that opendb creates a default admin user "test" with "test" as password.
This is IMHO a security hole, but I would like to hear your opinion -
is this okay or not?

Regards
Evgeni