app.py in the Backup Download component of the Amnezia-Web-Panel allows an attacker to use default credentials. This flaw enables unauthenticated or low‑privilege users to download backups that were intended to be protected. Because the vulnerability lies in a core component that is reachable over the network, an attacker can establish a remote session, bypass authentication, and retrieve potentially sensitive configuration and user data. The flaw is represented by CWE-1392, indicating that default credentials are left in place.

PRVTPRO Amnezia‑Web‑Panel versions up to 1.6.2 and 1.7.2 contain the vulnerable app.py file. The problem is tied to the backup download feature, which is frequently used by administrators to export network configuration. All releases prior to the stated cutoffs are considered vulnerable.

The CVSS score of 6.9 reflects a moderate risk, and the absence of EPSS data and a KEV listing suggests no current high‑profile exploitation but the public disclosure of the exploit means it is readily available. The attack vector is remote; an attacker only needs network access to the panel’s backup endpoint. Because the vendor response was delayed, the window for exploitation remains open until an upstream fix is deployed.