This solution presented here: How do I change geoserver admin password? doesn't work.
I have GeoServer 2.7.4 up and running, I went into the admin pane/ users, changed the default password, still no joy. Restarted the server, the old password still works. Interesting enough, the new password works too.
I went restarting the whole machine, with no luck. Then I deleted the admin user after creating a replacement one (admin2 with a different password), so now the "admin" account is gone, still I can use it to login. I know this is not the master root account, but why I can't get rid of it? I think all the other GeoServer instances of the same version have the same vulnerability.