CVE-2025-10560 describes a critical vulnerability in Silver Leaf Technologies, Inc.'s Worksnaps.net Worksnaps client application prior to version 1.6.20260201. The client binaries contain hardcoded AWS credentials, including access keys authenticated as the AWS root account. These credentials expose access to production cloud resources, including S3 buckets with sensitive data such as user desktop screenshots. The vulnerability allows an unauthenticated attacker who obtains the client binaries to extract these credentials and gain unauthorized access to the cloud environment. The vulnerability is categorized under CWE-798 (Use of Hard-coded Credentials) and has a CVSS 4.0 score of 9.3, indicating critical impact with network attack vector, no required privileges or user interaction, and high confidentiality, integrity, and availability impacts. The affected product is a cloud service, and the vendor manages remediation on the server side.

The exposure of AWS root account credentials embedded in client binaries allows an attacker to access Worksnaps production cloud resources, including S3 buckets containing sensitive user data such as screenshots. This can lead to unauthorized data access, data leakage, and potential compromise of cloud infrastructure. The vulnerability has a critical impact on confidentiality, integrity, and availability of the affected cloud resources.

A patch is available for this vulnerability, and the vendor manages remediation for this cloud-hosted service. Users should upgrade to version 1.6.20260201 or later where the hardcoded credentials issue is resolved. Since this is a cloud service, the vendor is responsible for server-side remediation. Check the vendor advisory for confirmation and apply any recommended updates promptly.