Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2026-25505

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Prior to version 0.1.7, a hardcoded secret key used for signing JWTs is checked into source code and ManyAPI routes do not check authentication. This issue has been patched in version 0.1.7.

VectorNETWORK

PublishedFeb 04, 2026, 20:16

Published Bysecurity-advisories@github.com

Base Score

Score9.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

bambuddy(PyPI)00.1.7N/A

References

https://github.com/maziggy/bambuddy/blob/a9bb8ed8239602bf08a9914f85a09eeb2bf13d15/backend/app/core/auth.py#L28
https://github.com/maziggy/bambuddy/blob/main/CHANGELOG.md
https://github.com/maziggy/bambuddy/commit/a82f9278d2d587b7042a0858aab79fd8b6e3add9
https://github.com/maziggy/bambuddy/commit/c31f2968889c855f1ffacb700c2c9970deb2a6fb
https://github.com/maziggy/bambuddy/pull/225
https://github.com/maziggy/bambuddy/releases/tag/v0.1.7
https://github.com/maziggy/bambuddy/security/advisories/GHSA-gc24-px2r-5qmf

Weakness Type

CWE-306

CVSS Metrics

Base Score

9.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base SeverityCritical

Version

3.1

Attack Vector (AV)

NETWORK