Authentication Bypass in Bambu Lab Print Management System by Bambuddy
CVE-2026-25505

9.8CRITICAL

Key Information:

Vendor

Maziggy

Status
Bambuddy
Vendor
CVE Published:
4 February 2026

What is CVE-2026-25505?

Bambuddy, a self-hosted print archive and management system designed for Bambu Lab 3D printers, has a significant vulnerability where a hardcoded secret key used for signing JSON Web Tokens (JWTs) was included in the source code. This oversight allows for potential unauthorized access, as many API routes within the application did not enforce authentication checks. Users are encouraged to update to version 0.1.7, where this vulnerability has been addressed, enhancing the overall security of the system.

Affected Version(s)

bambuddy < 0.1.7

References

https://github.com/maziggy/bambuddy/security/advisories/G...
x_refsource_CONFIRM
https://github.com/maziggy/bambuddy/pull/225
x_refsource_MISC
https://github.com/maziggy/bambuddy/commit/a82f9278d2d587...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.