Back to overview

CVE-2026-25505

CRITICAL Exploitation: PoC
9.8
CVSS 3.1
Description
Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Prior to version 0.1.7, a hardcoded secret key used for signing JWTs is checked into source code and ManyAPI routes do not check authentication. This issue has been patched in version 0.1.7.

Metadata

CVE ID
CVE-2026-25505
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-02-02 18:21 UTC
Published
2026-02-04 20:06 UTC
Last updated
2026-02-06 18:41 UTC
Primary CWE
CWE-306
CWE-306: Missing Authentication for Critical Function
Vendor / Product
maziggy / bambuddy
Sources
cve.org  ·  NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
maziggy bambuddy — < 0.1.7
Weakness (CWE)
CWESourceDescription
CWE-306 cna CWE-306: Missing Authentication for Critical Function
CWE-321 cna CWE-321: Use of Hard-coded Cryptographic Key
CVSS scores (1)
ScoreSeverityVersionSourceVector
9.8 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References (7)
Back to overview