CVE-2026-25505

CRITICAL

bambuddy < 0.1.7 - Unauthenticated Use of Hard-coded Cryptographic Key

Title source: llm
STIX 2.1

Description

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Prior to version 0.1.7, a hardcoded secret key used for signing JWTs is checked into source code and ManyAPI routes do not check authentication. This issue has been patched in version 0.1.7.

References (7)

Core 7
Core References
Issue Tracking x_refsource_misc
https://github.com/maziggy/bambuddy/pull/225

Scores

CVSS v3 9.8
EPSS 0.0072
EPSS Percentile 49.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-321 CWE-306
Status published
Products (2)
bambuddy/bambuddy < 0.1.7
pypi/bambuddy 0 - 0.1.7PyPI
Published Feb 04, 2026
Tracked Since Feb 18, 2026