Hardcoded AWS Root Credentials in Worksnaps Client Exposed Production S3 Data

Silver Leaf Technologies' Worksnaps client was found to contain hardcoded cloud credentials that exposed the company's production environment, a flaw tracked as CVE-2025-10560 and rated critical. Security researchers reported that affected client versions before 1.6.20260201 embedded AWS access keys, S3 bucket names, and related cloud access details in application binaries, allowing anyone who obtained the software to extract the secrets. The disclosed credentials reportedly authenticated as the vendor's AWS root identity, enabling access to production resources including S3 buckets that stored sensitive user data such as screenshots of employee desktops.

SEC Consult said the issue extended beyond the initial embedded keys: after the vendor removed the original hardcoded root credentials, the client still received decryptable AWS credentials from the server during login, leaving access to screenshot buckets effectively unresolved for a period. Researchers also noted additional hardcoded UCloud credentials, though their validity was not confirmed. Worksnaps has since released 1.6.20260201 as the fixed version, while recommended response actions include immediate credential rotation, restricting or removing sensitive data from exposed buckets, and upgrading all affected clients.