The vulnerability allows an attacker to modify the /root/viper/.git/config file, resulting in hard‑coded credentials being exposed. This can provide the attacker with valid credentials for the Viper service, enabling unauthorized access or potential privilege escalation if the discovered account has elevated rights. The weakness is a misuse of hard‑coded passwords (CWE‑259) and the use of hard‑coded credentials (CWE‑798).

FunnyWolf Viper versions up to and including 3.1.11 are affected. Packages named FunnyWolf:Viper with any subversion below the 3.1.12 release are vulnerable; the vulnerability is present on installations that include the .git directory under /root/viper.

The CVSS score of 6.9 indicates a moderate severity depending on the system configuration. The EPSS score is not available, but the public release of the exploit and the remote nature of the attack suggest a tangible risk. The vulnerability is not listed in the CISA KEV catalog, yet remote exploitation is feasible by modifying a local file that is presumed accessible to an attacker, producing exposed credentials. If the attacker obtains these credentials, they can authenticate to the Viper service without needing additional privileges.