CVE Intelligence
Analysis AI-assisted

CVE-2026-25505: Bambuddy: hardcoded JWT signing key and missing authentication

CVE-2026-25505 affects Bambuddy versions before 0.1.7, a self-hosted print archive for Bambu Lab 3D printers. The record describes a hardcoded secret used to sign JWTs and API routes that do not check authentication, with a CVSS 3.1 base score of 9.8 from the CNA. The issue is fixed in 0.1.7, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. According to the record, versions before 0.1.7 use a hardcoded secret key to sign JSON Web Tokens (JWTs), and some API routes do not check authentication. The issue is fixed in version 0.1.7.

Impact

  • The record classifies the weakness as CWE-306, Missing Authentication for Critical Function.
  • The CVSS 3.1 base score from the CNA is 9.8, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network attack with no privileges or user interaction required.
  • Because the signing key is stored in source code, anyone who can read that code may know it, which would let them create tokens that the application accepts (inference).

Affected products and versions

  • Bambuddy Bambuddy: versions below 0.1.7, according to the record.
  • The record lists patch references in the Bambuddy GitHub repository, including commits and pull request 225.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record.
  • No confirmed active exploitation appears in the sources consulted.
  • The record includes a GitHub advisory reference with an Exploit tag. The content behind that tag was not available for review, so it is not treated as confirmation of exploitation.

Remediation and mitigation

  • Upgrade Bambuddy to version 0.1.7 or later. This is the fix named in the record.
  • After upgrading, replace the JWT signing secret with a newly generated value, since the previous value was exposed in source code (inference).
  • Invalidate existing sessions and tokens issued before the upgrade, because they may have been signed with the exposed key (inference).
  • Do not expose the application directly to the internet. Place it behind a VPN or a trusted network boundary until it is updated.
  • Read the release notes for v0.1.7 and the GitHub security advisory.

Detection guidance

  • Check which Bambuddy version is deployed in your environment and identify any instance below 0.1.7.
  • Review web and API access logs for requests to Bambuddy API routes that lack a valid authenticated session, especially from unexpected sources.
  • Look for sessions or tokens that were not created through the normal login flow.
  • Monitor for unexpected changes in print archive data or configuration on affected instances.

Limitations of the available information

  • The record does not include a title, so the title used here was written from the description.
  • The description refers to ManyAPI routes without listing them. The exact affected endpoints are unknown from the record.
  • The record does not state whether the exposed key is the same in all deployments or whether it can be changed through configuration. This is unknown.
  • The contents of the referenced commits and the source file were not reviewed, so the details of the code change are unknown.
  • No EPSS or SSVC data is available in the record.

Frequently asked questions

What is CVE-2026-25505?

It is a vulnerability in Bambuddy, a self-hosted print archive for Bambu Lab 3D printers. Versions before 0.1.7 use a hardcoded key to sign JWTs and some API routes do not check authentication.

Which version fixes the issue?

According to the record, the issue is patched in version 0.1.7. Upgrade to that version or later.

Is this vulnerability being actively exploited?

The CVE is not listed in the CISA KEV catalog in the record, and no confirmed active exploitation appears in the sources consulted.

What should I do after upgrading?

Replace the JWT signing secret with a newly generated value and invalidate sessions issued before the upgrade, since the old key was exposed in source code.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.