LazyOwn CVE-2026-68503

LazyOwn is a Python-based, AI-powered command-and-control (C2) and red-team operations framework. The affected component is lazyc2.py, a Flask/SocketIO web server that fronts the operator dashboard and uses HTTP Basic authentication for access control. The credentials are sourced from static configuration (payload.json) and a schema module (core/payload_schema.py) that both hardcode the username and password 'LazyOwn', which are then handed to the server's check_auth routine as command-line arguments (sys.argv[2]/sys.argv[3]). This is a classic instance of CWE-1392 (Use of Default Credentials): the product is deployed with a well-known, publicly documented credential pair that operators are not forced to change before the service is exposed. The fix commit (2e1e3a7) adds an is_insecure_credential() check that rejects the weak/default set and auto-generates 20-character random credentials, tightens check_auth to reject empty/short passwords, and - notably - retrofits @login_required and current_user.is_authenticated guards onto numerous previously unprotected routes and SocketIO handlers (logout, banners, mitre, get_connected_clients, lazybot, lazyreport, teamserver, report, pty_input, resize, connect), indicating the exposure extended beyond just the default password to missing per-endpoint authorization.