CVEvulnerability

CVE-2026-25505

9.8 CRITICAL Published 2026-02-04 Modified 2026-06-17 Official page ↗

Status: Analyzed
Published: 2026-02-04
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-306, CWE-321

Description

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Prior to version 0.1.7, a hardcoded secret key used for signing JWTs is checked into source code and ManyAPI routes do not check authentication. This issue has been patched in version 0.1.7.

Affected configurations

• bambuddy bambuddy (< 0.1.7)

Weakness · CWE (2)

CWE-306 Missing Authentication for Critical Functionality weakness
CWE-321 Use of Hard-coded Cryptographic Key weakness

References

https://github.com/maziggy/bambuddy/blob/a9bb8ed8239602bf08a9914f85a09eeb2bf13d15/backend/app/core/auth.py#L28 Patch
https://github.com/maziggy/bambuddy/blob/main/CHANGELOG.md Release Notes
https://github.com/maziggy/bambuddy/commit/a82f9278d2d587b7042a0858aab79fd8b6e3add9 Patch
https://github.com/maziggy/bambuddy/commit/c31f2968889c855f1ffacb700c2c9970deb2a6fb Patch
https://github.com/maziggy/bambuddy/pull/225 Issue Tracking, Patch
https://github.com/maziggy/bambuddy/releases/tag/v0.1.7 Product, Release Notes
https://github.com/maziggy/bambuddy/security/advisories/GHSA-gc24-px2r-5qmf Exploit, Vendor Advisory

CVE-2026-25505

Description

Affected configurations

Related

Weakness · CWE (2)

References