CVE-2026-25505 Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication
Attackers can bypass authentication and access sensitive data due to hardcoded JWT keys and missing auth checks in Bambuddy.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25505?
CVE-2026-25505 is a critical vulnerability in maziggy bambuddy, published on 4 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Prior to version 0.1.7, a hardcoded secret key used for signing JWTs is checked into source code and ManyAPI routes do not check authentication. This issue has been patched in version 0.1.7.
Which versions are affected by CVE-2026-25505?
2 open source packages ship an affected version, including bambuddy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
bambuddy PyPI | All versions | 0.1.7 |
bambuddy PyPI | All versions | 0.1.7 |
Products include Bambuddy Bambuddy.
How do I fix CVE-2026-25505?
Upgrade bambuddy to 0.1.7 or later.
Is CVE-2026-25505 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25505 exists.
Sources
Also known as GHSA-gc24-px2r-5qmf.