CVE-2026-68503

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-68503
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68503.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-68503
Aliases
  • GHSA-38jf-j9x7-jf6f
Published
2026-07-30T20:39:34Z
Modified
2026-11-04T02:48:17Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
LazyOwn: Default C2 Operator Credentials Enable Administrative Access to C2 Dashboard
Details

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payload_schema.py and passes them unchanged to lazyc2.py HTTP Basic authentication, allowing any network-reachable attacker who knows the defaults to authenticate to the C2 dashboard with operator-level access. This issue is fixed in 0.2.154.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1392"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68503.json"
}
References

Affected packages

Git / github.com/grisuno/lazyown

Affected ranges

Type
GIT
Repo
https://github.com/grisuno/lazyown
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5851b2ff9d4a0e7988e23c43a07e6aef3792e5c2
Fixed
2e1e3a7b5da8149ae28a970b5883aefa42921652
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.2.154"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "2e1e3a7b5da8149ae28a970b5883aefa42921652"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

release/0.*
release/0.0.0
release/0.0.1
release/0.0.10
release/0.0.11
release/0.0.12
release/0.0.13
release/0.0.14
release/0.0.2
release/0.0.3
release/0.0.4
release/0.0.5
release/0.0.6
release/0.0.7
release/0.0.8
release/0.0.9
release/0.1.0
release/0.1.1
release/0.1.10
release/0.1.11
release/0.1.12
release/0.1.13
release/0.1.14
release/0.1.15
release/0.1.16
release/0.1.17
release/0.1.18
release/0.1.19
release/0.1.2
release/0.1.20
release/0.1.21
release/0.1.22
release/0.1.23
release/0.1.24
release/0.1.25
release/0.1.26
release/0.1.27
release/0.1.28
release/0.1.29
release/0.1.3
release/0.1.30
release/0.1.31
release/0.1.32
release/0.1.33
release/0.1.34
release/0.1.35
release/0.1.36
release/0.1.37
release/0.1.38
release/0.1.39
release/0.1.4
release/0.1.40
release/0.1.41
release/0.1.42
release/0.1.43
release/0.1.44
release/0.1.45
release/0.1.46
release/0.1.47
release/0.1.48
release/0.1.49
release/0.1.5
release/0.1.50
release/0.1.51
release/0.1.52
release/0.1.53
release/0.1.54
release/0.1.55
release/0.1.56
release/0.1.57
release/0.1.58
release/0.1.59
release/0.1.6
release/0.1.60
release/0.1.61
release/0.1.62
release/0.1.63
release/0.1.64
release/0.1.65
release/0.1.66
release/0.1.7
release/0.1.8
release/0.1.9
release/0.2.100
release/0.2.103
release/0.2.104
release/0.2.105
release/0.2.106
release/0.2.107
release/0.2.108
release/0.2.109
release/0.2.110
release/0.2.111
release/0.2.112
release/0.2.113
release/0.2.114
release/0.2.115
release/0.2.116
release/0.2.117
release/0.2.118
release/0.2.119
release/0.2.12
release/0.2.120
release/0.2.121
release/0.2.122
release/0.2.123
release/0.2.124
release/0.2.125
release/0.2.126
release/0.2.127
release/0.2.128
release/0.2.129
release/0.2.13
release/0.2.130
release/0.2.131
release/0.2.132
release/0.2.133
release/0.2.134
release/0.2.135
release/0.2.137
release/0.2.138
release/0.2.139
release/0.2.14
release/0.2.140
release/0.2.141
release/0.2.142
release/0.2.144
release/0.2.145
release/0.2.146
release/0.2.147
release/0.2.148
release/0.2.149
release/0.2.15
release/0.2.150
release/0.2.151
release/0.2.152
release/0.2.153
release/0.2.16
release/0.2.17
release/0.2.18
release/0.2.19
release/0.2.20
release/0.2.21
release/0.2.22
release/0.2.23
release/0.2.24
release/0.2.25
release/0.2.26
release/0.2.27
release/0.2.28
release/0.2.29
release/0.2.30
release/0.2.33
release/0.2.34
release/0.2.35
release/0.2.36
release/0.2.37
release/0.2.38
release/0.2.39
release/0.2.40
release/0.2.41
release/0.2.42
release/0.2.43
release/0.2.45
release/0.2.46
release/0.2.47
release/0.2.48
release/0.2.49
release/0.2.50
release/0.2.51
release/0.2.52
release/0.2.53
release/0.2.54
release/0.2.55
release/0.2.56
release/0.2.57
release/0.2.58
release/0.2.59
release/0.2.60
release/0.2.61
release/0.2.62
release/0.2.63
release/0.2.64
release/0.2.66
release/0.2.67
release/0.2.73
release/0.2.74
release/0.2.75
release/0.2.76
release/0.2.77
release/0.2.78
release/0.2.79
release/0.2.80
release/0.2.81
release/0.2.86
release/0.2.88
release/0.2.90
release/0.2.91
release/0.2.92
release/0.2.93
release/0.2.94
release/0.2.95
release/0.2.96
release/0.2.97
release/0.2.98
release/0.2.99
vrelease/0.*
vrelease/0.0.0
vvrelease/0.*
vvrelease/0.0.0
vvvrelease/0.*
vvvrelease/0.0.0
vvvrelease/0.1.0
vvvrelease/0.1.1
vvvrelease/0.1.2
vvvrelease/0.2.0
vvvrelease/0.2.1
vvvrelease/0.2.10
vvvrelease/0.2.11
vvvrelease/0.2.2
vvvrelease/0.2.3
vvvrelease/0.2.4
vvvrelease/0.2.5
vvvrelease/0.2.6
vvvrelease/0.2.7
vvvrelease/0.2.8
vvvrelease/0.2.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68503.json"