CVE-2026-25505: Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-04 · updated 2026-06-17
Weakness: CWE-306

Description

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Prior to version 0.1.7, a hardcoded secret key used for signing JWTs is checked into source code and ManyAPI routes do not check authentication. This issue has been patched in version 0.1.7.

Affected products

maziggy bambuddy: before 0.1.7 — fixed in 0.1.7

How to fix

Upgrade to a fixed version: maziggy bambuddy 0.1.7. Check the vendor advisory for mitigations.

References

https://github.com/maziggy/bambuddy/blob/a9bb8ed8239602bf08a9914f85a09eeb2bf13d15/backend/app/core/auth.py#L28
https://github.com/maziggy/bambuddy/blob/main/CHANGELOG.md
https://github.com/maziggy/bambuddy/commit/a82f9278d2d587b7042a0858aab79fd8b6e3add9
https://github.com/maziggy/bambuddy/commit/c31f2968889c855f1ffacb700c2c9970deb2a6fb
https://github.com/maziggy/bambuddy/pull/225
https://github.com/maziggy/bambuddy/releases/tag/v0.1.7
https://github.com/maziggy/bambuddy/security/advisories/GHSA-gc24-px2r-5qmf

Get alerted when CVE-2026-25505 or the next vulnerability affects your stack