CVE-2026-108783: Use of Default Credentials in PRVTPRO Amnezia-Web-Panel

This vulnerability in PRVTPRO Amnezia-Web-Panel up to versions 1.6.2 and 1.7.2 allows remote attackers to leverage default credentials due to improper handling in the Backup Download component within the app.py file. The issue enables unauthorized access without requiring user interaction or privileges. The exploit has been publicly disclosed, increasing the risk of exploitation. The vendor was notified but has not issued any response or patch.

Exploitation of this vulnerability can lead to unauthorized remote access to the affected system using default credentials. This could allow attackers to download backups or access sensitive data managed by the Amnezia-Web-Panel. The CVSS 4.0 score of 6.9 indicates a medium severity impact with network attack vector, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider mitigating the risk by changing default credentials immediately if possible and restricting network access to the Backup Download functionality until an official fix is available.