Vulnerability Details CVE-2026-25505
Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Prior to version 0.1.7, a hardcoded secret key used for signing JWTs is checked into source code and ManyAPI routes do not check authentication. This issue has been patched in version 0.1.7.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 29.2%
CVSS Severity
CVSS v3 Score 9.8
References
- https://github.com/maziggy/bambuddy/blob/a9bb8ed8239602bf08a9914f85a09eeb2bf13d15/backend/app/core/auth.py#L28
- https://github.com/maziggy/bambuddy/blob/main/CHANGELOG.md
- https://github.com/maziggy/bambuddy/commit/a82f9278d2d587b7042a0858aab79fd8b6e3add9
- https://github.com/maziggy/bambuddy/commit/c31f2968889c855f1ffacb700c2c9970deb2a6fb
- https://github.com/maziggy/bambuddy/pull/225
- https://github.com/maziggy/bambuddy/releases/tag/v0.1.7
- https://github.com/maziggy/bambuddy/security/advisories/GHSA-gc24-px2r-5qmf