CVE-2026-25505

Katalog CVE

CVSS 9.8 · Critical EPSS 1,0%

Kerentanan Missing Authentication for Critical Function pada bambuddy. Skor CVSS 3.1 9.8 (Critical) menurut github.com.

Deskripsi (NVD)

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Prior to version 0.1.7, a hardcoded secret key used for signing JWTs is checked into source code and ManyAPI routes do not check authentication. This issue has been patched in version 0.1.7.

Rincian

Terbit di NVD

4 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function
CWE-321: Use of Hard-coded Cryptographic Key

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/maziggy/bambuddy/security/advisories/GHSA-gc24-px2r-5qmf exploit · advisory vendor
• https://github.com/maziggy/bambuddy/blob/a9bb8ed8239602bf08a9914f85a09eeb2bf13d15/backend/app/core/auth.py#L28 patch
• https://github.com/maziggy/bambuddy/commit/a82f9278d2d587b7042a0858aab79fd8b6e3add9 patch
• https://github.com/maziggy/bambuddy/commit/c31f2968889c855f1ffacb700c2c9970deb2a6fb patch
• https://github.com/maziggy/bambuddy/pull/225 issue tracking · patch
• https://github.com/maziggy/bambuddy/blob/main/CHANGELOG.md release notes
• https://github.com/maziggy/bambuddy/releases/tag/v0.1.7 product · release notes