CVE-2026-108783 flags a weakness in Amnezia-Web-Panel, a management interface for the Amnezia VPN, in versions up to 1.6.2 and 1.7.2. The backup download feature in app.py relies on default credentials, letting a remote attacker reach it without ever changing the password. Proof-of-concept exploit code is already public, and the vendor has not responded to the disclosure.
// source: nvd.nist.gov ↗