CVE-2026-53459criticalCWE-636 CWE-755

Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.3epss 0.4%

probabilidade de exploração

0.4%top 64% das CVEs

exploração observada

nãonenhuma fonte reporta

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.4.4, a fail-open in the authentication code allows any attacker to bypass authentication by flooding a public endpoint to exhaust resources causing database access to fail, granting unauthenticated access to all protected endpoints. Version 0.2.4.4 patches the issue.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Produtos afetados

maziggy · bambuddy

Referências

https://github.com/maziggy/bambuddy/blob/449502cc9fc1cec04f06d31512420eac729fd032/backend/app/core/auth.py#L473-L483 https://github.com/maziggy/bambuddy/blob/449502cc9fc1cec04f06d31512420eac729fd032/backend/app/main.py#L5314-L5316 https://github.com/maziggy/bambuddy/blob/main/CHANGELOG.md https://github.com/maziggy/bambuddy/commit/845ad39b19bf99afeea571c6bae09695777e1460 https://github.com/maziggy/bambuddy/releases/tag/v0.2.4.4 https://github.com/maziggy/bambuddy/security/advisories/GHSA-6mf4-q26m-47pv