CVE-2026-25505

Name: CVE-2026-25505
Creator: NVD / NIST
Published: 2026-02-04T20:16:07.707+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.8/10EPSS 0.72%

Last modified Jun 17, 2026

CVE-2026-25505 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Prior to version 0.1.7, a hardcoded secret key used for signing JWTs is checked into source code and ManyAPI routes do not check authentication. EPSS estimates a 0.72% chance of exploitation in the next 30 days.

Description

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Prior to version 0.1.7, a hardcoded secret key used for signing JWTs is checked into source code and ManyAPI routes do not check authentication. This issue has been patched in version 0.1.7.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.72%

49.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Bambuddy	Bambuddy	< 0.1.7

References

https://github.com/maziggy/bambuddy/blob/a9bb8ed8239602bf08a9914f85a09eeb2bf13d15/backend/app/core/auth.py#L28Patch
https://github.com/maziggy/bambuddy/blob/main/CHANGELOG.mdRelease Notes
https://github.com/maziggy/bambuddy/commit/a82f9278d2d587b7042a0858aab79fd8b6e3add9Patch
https://github.com/maziggy/bambuddy/commit/c31f2968889c855f1ffacb700c2c9970deb2a6fbPatch
https://github.com/maziggy/bambuddy/pull/225Issue Tracking, Patch
https://github.com/maziggy/bambuddy/releases/tag/v0.1.7Product, Release Notes
https://github.com/maziggy/bambuddy/security/advisories/GHSA-gc24-px2r-5qmfExploit, Vendor Advisory

Timeline

Published: Feb 4, 2026
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2026-25505?

How severe is CVE-2026-25505?

CVE-2026-25505 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 0.72% probability of exploitation in the next 30 days.

How do I fix CVE-2026-25505?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-25505?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST