agl app-framework-binder (afb‑daemon) contains a code path that purposely clears the request credentials before calling an attacker‑controlled API. The verifier controls the API name and verb via JSON input, so every registered API is invoked with a null credential context. When an API subsequently checks the user’s credentials, the missing information can cause a failure‑open, letting the attacker obtain elevated privileges on the system. This flaw falls under the category of improper privilege management and can lead to system compromise. The CVSS score of 7.8 classifies it as high severity. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, but the potential impact remains significant.

vulnerable versions of AGL app-framework-binder up to and including v19.90.0 are affected. Any system running this daemon and its APIs, especially those that use the credential field for authorization decisions, is at risk. The risk does not extend beyond the affected product itself.

The vulnerability is exploitable remotely via the supervision Do command and requires the attacker to send a crafted JSON request specifying the target API and verb. No special network access prerequisites beyond those needed to interact with afb‑daemon are required. Because the API can be swapped arbitrarily and credentials are forced to null, an attacker can trigger privileged operations that would normally be denied, potentially leading to complete control of the device. The lack of an official patch and the high CVSS score underscore the urgency of remediation.