CVE-2026-25505

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-25505

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

B

ambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Prior to version 0.1.7, a hardcoded secret key used for signing JWTs is checked into source code and ManyAPI routes do not check authentication. This issue has been patched in version 0.1.7.

References
Link Resource
https://github.com/maziggy/bambuddy/blob/a9bb8ed8239602bf08a9914f85a09eeb2bf13d15/backend/app/core/auth.py#L28 Patch
https://github.com/maziggy/bambuddy/blob/main/CHANGELOG.md Release Notes
https://github.com/maziggy/bambuddy/commit/a82f9278d2d587b7042a0858aab79fd8b6e3add9 Patch
https://github.com/maziggy/bambuddy/commit/c31f2968889c855f1ffacb700c2c9970deb2a6fb Patch
https://github.com/maziggy/bambuddy/pull/225 Issue Tracking Patch
https://github.com/maziggy/bambuddy/releases/tag/v0.1.7 Product Release Notes
https://github.com/maziggy/bambuddy/security/advisories/GHSA-gc24-px2r-5qmf Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:bambuddy:bambuddy:*:*:*:*:*:*:*:*
History

27 Feb 2026, 20:25

Type Values Removed Values Added
First Time Bambuddy bambuddy
Bambuddy
CPE cpe:2.3:a:bambuddy:bambuddy:*:*:*:*:*:*:*:*
Summary
  • (es) Bambuddy es un sistema autoalojado de archivo y gestión de impresiones para impresoras 3D Bambu Lab. Antes de la versión 0.1.7, una clave secreta codificada utilizada para firmar JWTs está incluida en el código fuente y las rutas de ManyAPI no verifican la autenticación. Este problema ha sido parcheado en la versión 0.1.7.
References () https://github.com/maziggy/bambuddy/blob/a9bb8ed8239602bf08a9914f85a09eeb2bf13d15/backend/app/core/auth.py#L28 - () https://github.com/maziggy/bambuddy/blob/a9bb8ed8239602bf08a9914f85a09eeb2bf13d15/backend/app/core/auth.py#L28 - Patch
References () https://github.com/maziggy/bambuddy/blob/main/CHANGELOG.md - () https://github.com/maziggy/bambuddy/blob/main/CHANGELOG.md - Release Notes
References () https://github.com/maziggy/bambuddy/commit/a82f9278d2d587b7042a0858aab79fd8b6e3add9 - () https://github.com/maziggy/bambuddy/commit/a82f9278d2d587b7042a0858aab79fd8b6e3add9 - Patch
References () https://github.com/maziggy/bambuddy/commit/c31f2968889c855f1ffacb700c2c9970deb2a6fb - () https://github.com/maziggy/bambuddy/commit/c31f2968889c855f1ffacb700c2c9970deb2a6fb - Patch
References () https://github.com/maziggy/bambuddy/pull/225 - () https://github.com/maziggy/bambuddy/pull/225 - Issue Tracking, Patch
References () https://github.com/maziggy/bambuddy/releases/tag/v0.1.7 - () https://github.com/maziggy/bambuddy/releases/tag/v0.1.7 - Product, Release Notes
References () https://github.com/maziggy/bambuddy/security/advisories/GHSA-gc24-px2r-5qmf - () https://github.com/maziggy/bambuddy/security/advisories/GHSA-gc24-px2r-5qmf - Exploit, Vendor Advisory

06 Feb 2026, 19:16

Type Values Removed Values Added
References
  • () https://github.com/maziggy/bambuddy/blob/main/CHANGELOG.md -
  • () https://github.com/maziggy/bambuddy/commit/c31f2968889c855f1ffacb700c2c9970deb2a6fb -
  • () https://github.com/maziggy/bambuddy/pull/225 -
  • () https://github.com/maziggy/bambuddy/releases/tag/v0.1.7 -

04 Feb 2026, 20:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-04 20:16

Updated : 2026-02-27 20:25

NVD link : CVE-2026-25505

Mitre link : CVE-2026-25505

CVE.ORG link : CVE-2026-25505

JSON object : View

Products Affected

bambuddy

CWE
CWE-306

Missing Authentication for Critical Function

CWE-321

Use of Hard-coded Cryptographic Key