diff --git a/http/default-logins/camunda/camunda-default-login.yaml b/http/default-logins/camunda/camunda-default-login.yaml
new file mode 100644
index 0000000000..23e9831885
--- /dev/null
+++ b/http/default-logins/camunda/camunda-default-login.yaml
@@ -0,0 +1,62 @@
+id: camunda-default-login
+
+info:
+  name: Camunda - Default Login
+  author: bhutch
+  severity: high
+  description: |
+    Camunda login panel contains a default login vulnerability.
+  reference:
+    - https://github.com/camunda/camunda-docs-manual/blob/master/content/webapps/admin/user-management.md
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
+    cvss-score: 8.3
+    cwe-id: CWE-522
+  metadata:
+    verified: true
+    shodan-query: http.html:"Camunda Welcome"
+  tags: default-login,camunda
+
+http:
+  - raw:
+      - |
+        GET /camunda/app/welcome/default/ HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /camunda/api/admin/auth/user/default/login/welcome HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded;charset=UTF-8
+        Accept: application/json, text/plain, */*
+        X-Xsrf-Token: {{xsrf_token}}
+
+        username={{username}}&password={{password}}
+
+    attack: pitchfork
+    payloads:
+      username:
+        - demo
+      password:
+        - demo
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '"userId"'
+          - '"authorizedApps"'
+        condition: and
+
+      - type: status
+        status:
+          - 200
+
+    extractors:
+      - type: regex
+        name: xsrf_token
+        group: 1
+        internal: true
+        part: header
+        regex:
+          - '(?i)Set-Cookie: XSRF-TOKEN=([A-Za-z0-9_.-]+)'