PT-2026-6298 · Bambu+1 · Bambu Lab 3D Printers+1

Speenah · Published 2026-02-02 · Updated 2026-02-06 · CVE-2026-25505

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bambuddy versions prior to 0.1.7

Description Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Versions before 0.1.7 include a hardcoded secret key used for signing JSON Web Tokens (JWTs). Multiple API routes do not enforce authentication checks. This allows potential bypass of security controls and trivial token forgery, granting full system access.

Recommendations Update Bambuddy to version 0.1.7.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

CWE-321

Related Identifiers

CVE-2026-25505

GHSA-GC24-PX2R-5QMF

Affected Products

Bambu Lab 3D Printers

Bambuddy

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25505.json · Exploit
• https://github.com/maziggy/bambuddy/security/advisories/GHSA-gc24-px2r-5qmf · Vendor Advisory
• https://github.com/maziggy/bambuddy/blob/a9bb8ed8239602bf08a9914f85a09eeb2bf13d15/backend/app/core/auth.py#L28 · Patch
• https://github.com/maziggy/bambuddy/pull/225 · Patch
• https://github.com/maziggy/bambuddy/commit/a82f9278d2d587b7042a0858aab79fd8b6e3add9 · Patch
• https://github.com/maziggy/bambuddy/commit/c31f2968889c855f1ffacb700c2c9970deb2a6fb · Patch
• https://osv.dev/vulnerability/CVE-2026-25505 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25505 · Security Note
• https://osv.dev/vulnerability/GHSA-gc24-px2r-5qmf · Vendor Advisory
• https://github.com/maziggy/bambuddy/blob/main/CHANGELOG.md · Note
• https://github.com/maziggy/bambuddy/releases/tag/v0.1.7 · Note
• https://github.com/maziggy/bambuddy · Note
• https://twitter.com/CveFindCom/status/2019428486390174076 · Twitter Post
• https://twitter.com/CVEnew/status/2019182777485439440 · Twitter Post
• https://t.me/cveNotify/151185 · Telegram Post