PT-2026-6298 · Bambu+1 · Bambu Lab 3D Printers+1

Speenah · Publicado 2026-02-02 · Atualizado 2026-02-06 · CVE-2026-25505

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bambuddy versions prior to 0.1.7

Description Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Versions before 0.1.7 include a hardcoded secret key used for signing JSON Web Tokens (JWTs). Multiple API routes do not enforce authentication checks. This allows potential bypass of security controls and trivial token forgery, granting full system access.

Recommendations Update Bambuddy to version 0.1.7.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

CWE-321

Identificadores relacionados

CVE-2026-25505

GHSA-GC24-PX2R-5QMF

Produtos afetados

Bambu Lab 3D Printers

Bambuddy

Referências · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25505.json · Exploit
• https://github.com/maziggy/bambuddy/security/advisories/GHSA-gc24-px2r-5qmf · Aviso do Fabricante
• https://github.com/maziggy/bambuddy/blob/a9bb8ed8239602bf08a9914f85a09eeb2bf13d15/backend/app/core/auth.py#L28 · Correção
• https://github.com/maziggy/bambuddy/pull/225 · Correção
• https://github.com/maziggy/bambuddy/commit/a82f9278d2d587b7042a0858aab79fd8b6e3add9 · Correção
• https://github.com/maziggy/bambuddy/commit/c31f2968889c855f1ffacb700c2c9970deb2a6fb · Correção
• https://github.com/maziggy/bambuddy/blob/main/CHANGELOG.md · Nota
• https://github.com/maziggy/bambuddy/releases/tag/v0.1.7 · Nota
• https://github.com/maziggy/bambuddy · Nota
• https://twitter.com/CveFindCom/status/2019428486390174076 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2019182777485439440 · Publicação no Twitter
• https://t.me/cveNotify/151185 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-25505 · Aviso do Fabricante
• https://twitter.com/0dayPublishing/status/2019145586386051535 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2019144080778031491 · Publicação no Twitter