{"id":"CVE-2026-68503","summary":"LazyOwn: Default C2 Operator Credentials Enable Administrative Access to C2 Dashboard","details":"LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payload_schema.py and passes them unchanged to lazyc2.py HTTP Basic authentication, allowing any network-reachable attacker who knows the defaults to authenticate to the C2 dashboard with operator-level access. This issue is fixed in 0.2.154.","aliases":["GHSA-38jf-j9x7-jf6f"],"modified":"2026-08-02T03:32:12.013701171Z","published":"2026-07-30T20:39:34.763Z","database_specific":{"cwe_ids":["CWE-1392"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68503.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/grisuno/LazyOwn/releases/tag/release/0.2.154"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68503.json"},{"type":"ADVISORY","url":"https://github.com/grisuno/LazyOwn/security/advisories/GHSA-38jf-j9x7-jf6f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68503"},{"type":"FIX","url":"https://github.com/grisuno/LazyOwn/commit/2e1e3a7b5da8149ae28a970b5883aefa42921652"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/grisuno/lazyown","events":[{"introduced":"0"},{"fixed":"2e1e3a7b5da8149ae28a970b5883aefa42921652"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"0.2.154"}]}}],"versions":["release/0.2.153","release/0.2.152","release/0.2.151","release/0.2.150","release/0.2.149","release/0.2.148","release/0.2.147","release/0.2.146","release/0.2.145","release/0.2.144","release/0.2.142","release/0.2.141","release/0.2.140","release/0.2.139","release/0.2.138","release/0.2.137","release/0.2.135","release/0.2.134","release/0.2.133","release/0.2.132","release/0.2.131","release/0.2.130","release/0.2.129","release/0.2.128","release/0.2.127","release/0.2.126","release/0.2.125","release/0.2.124","release/0.2.123","release/0.2.122","release/0.2.121","release/0.2.120","release/0.2.119","release/0.2.118","release/0.2.117","release/0.2.116","release/0.2.115","release/0.2.114","release/0.2.113","release/0.2.112","release/0.2.111","release/0.2.110","release/0.2.109","release/0.2.108","release/0.2.107","release/0.2.106","release/0.2.105","release/0.2.104","release/0.2.103","release/0.2.100","release/0.2.99","release/0.2.98","release/0.2.97","release/0.2.96","release/0.2.95","release/0.2.94","release/0.2.93","release/0.2.92","release/0.2.91","release/0.2.90","release/0.2.88","release/0.2.86","release/0.2.81","release/0.2.80","release/0.2.79","release/0.2.78","release/0.2.77","release/0.2.76","release/0.2.75","release/0.2.74","release/0.2.73","release/0.2.67","release/0.2.66","release/0.2.64","release/0.2.63","release/0.2.62","release/0.2.61","release/0.2.60","release/0.2.59","release/0.2.58","release/0.2.57","release/0.2.56","release/0.2.55","release/0.2.54","release/0.2.53","release/0.2.52","release/0.2.51","release/0.2.50","release/0.2.49","release/0.2.48","release/0.2.47","release/0.2.46","release/0.2.45","release/0.2.43","release/0.2.42","release/0.2.41","release/0.2.40","release/0.2.39","release/0.2.38","release/0.2.37","release/0.2.36","release/0.2.35","release/0.2.34","release/0.2.33","release/0.2.30","release/0.2.29","release/0.2.28","release/0.2.27","release/0.2.26","release/0.2.25","release/0.2.24","release/0.2.23","release/0.2.22","release/0.2.21","release/0.2.20","release/0.2.19","release/0.2.18","release/0.2.17","release/0.2.16","release/0.2.15","release/0.2.14","release/0.2.13","release/0.2.12","vvvrelease/0.2.11","vvvrelease/0.2.10","vvvrelease/0.2.9","vvvrelease/0.2.8","vvvrelease/0.2.7","vvvrelease/0.2.6","vvvrelease/0.2.5","vvvrelease/0.2.4","vvvrelease/0.2.3","vvvrelease/0.2.2","vvvrelease/0.2.1","vvvrelease/0.2.0","vvvrelease/0.1.2","vvvrelease/0.1.1","vvvrelease/0.1.0","vvvrelease/0.0.0","vvrelease/0.0.0","vrelease/0.0.0","release/0.0.0","release/0.1.66","release/0.1.65","release/0.1.64","release/0.1.63","release/0.1.62","release/0.1.61","release/0.1.60","release/0.1.59","release/0.1.58","release/0.1.57","release/0.1.56","release/0.1.55","release/0.1.54","release/0.1.53","release/0.1.52","release/0.1.51","release/0.1.50","release/0.1.49","release/0.1.48","release/0.1.47","release/0.1.46","release/0.1.45","release/0.1.44","release/0.1.43","release/0.1.42","release/0.1.41","release/0.1.40","release/0.1.39","release/0.1.38","release/0.1.37","release/0.1.36","release/0.1.35","release/0.1.34","release/0.1.33","release/0.1.32","release/0.1.31","release/0.1.30","release/0.1.29","release/0.1.28","release/0.1.27","release/0.1.26","release/0.1.25","release/0.1.24","release/0.1.23","release/0.1.22","release/0.1.21","release/0.1.20","release/0.1.19","release/0.1.18","release/0.1.17","release/0.1.16","release/0.1.15","release/0.1.14","release/0.1.13","release/0.1.12","release/0.1.11","release/0.1.10","release/0.1.9","release/0.1.8","release/0.1.7","release/0.1.6","release/0.1.5","release/0.1.4","release/0.1.3","release/0.1.2","release/0.1.1","release/0.1.0","release/0.0.14","release/0.0.13","release/0.0.12","release/0.0.11","release/0.0.10","release/0.0.9","release/0.0.8","release/0.0.7","release/0.0.6","release/0.0.5","release/0.0.4","release/0.0.3","release/0.0.2","release/0.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68503.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}