LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn …

CVE-2026-68503 affects the LazyOwn RedTeam/APT Framework, an AI-powered command-and-control (C2) and red-team operations framework. Prior to version 0.2.154, the framework shipped with hardcoded default credentials ('LazyOwn'/'LazyOwn') defined in payload.json and core/payload_schema.py. These credentials were passed unchanged to the lazyc2.py HTTP Basic Authentication handler. Any network-reachable attacker who knows the default credentials can authenticate to the C2 dashboard with full operator-level access. The vulnerability poses a significant risk as the framework is designed for offensive security operations, meaning unauthorized access could lead to serious misuse. The issue has been patched in version 0.2.154, with the fix available via the official GitHub release and commit.