CVE-2026-25505

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Prior to version 0.1.7, a hardcoded secret key used for signing JWTs is checked into source code and ManyAPI routes do not check authentication. This issue has been patched in version 0.1.7.

• CWE-306
• CWE-321

• https://github.com/maziggy/bambuddy/blob/a9bb8ed8239602bf08a9914f85a09eeb2bf13d15/backend/app/core/auth.py#L28Patch
• https://github.com/maziggy/bambuddy/blob/main/CHANGELOG.mdRelease Notes
• https://github.com/maziggy/bambuddy/commit/a82f9278d2d587b7042a0858aab79fd8b6e3add9Patch
• https://github.com/maziggy/bambuddy/commit/c31f2968889c855f1ffacb700c2c9970deb2a6fbPatch
• https://github.com/maziggy/bambuddy/pull/225Issue Tracking, Patch
• https://github.com/maziggy/bambuddy/releases/tag/v0.1.7Product, Release Notes
• https://github.com/maziggy/bambuddy/security/advisories/GHSA-gc24-px2r-5qmfExploit, Vendor Advisory

Published

Feb 4, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25499Terraform / OpenTofu Provider adds support for Proxmox Virtu…7.5
• CVE-2026-2550A vulnerability was found in EFM iptime A6004MX 14.18.2. Aff…9.8
• CVE-2026-25500Rack is a modular Ruby web server interface. Prior to versio…5.4
• CVE-2026-25501free5GC SMF provides Session Management Function for free5GC…7.5
• CVE-2026-25502iccDEV provides a set of libraries and tools that allow for …7.8
• CVE-2026-25503iccDEV provides a set of libraries and tools that allow for …7.1
• CVE-2026-25506MUNGE is an authentication service for creating and validati…7.8
• CVE-2026-25507ESF-IDF is the Espressif Internet of Things (IOT) Developmen…6.3
• CVE-2026-25508ESF-IDF is the Espressif Internet of Things (IOT) Developmen…6.3
• CVE-2026-25509CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a …5.3
• CVE-2026-2551A vulnerability was determined in ZenTao up to 21.7.8. Affec…5.4
• CVE-2026-25510CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a …8.8