CVE-2026-53459: falha crítica em maziggy bambuddy
Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 0.8%
Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.4.4, a fail-open in the authentication code allows any attacker to bypass authentication by flooding a public endpoint to exhaust resources causing database access to fail, granting unauthenticated access to all protected endpoints. Version 0.2.4.4 patches the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
maziggy · bambuddyCVEs relacionadas — maziggy bambuddy
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/maziggy/bambuddy/blob/449502cc9fc1cec04f06d31512420eac729fd032/backend/app/core/auth.py#L473-L483https://github.com/maziggy/bambuddy/blob/449502cc9fc1cec04f06d31512420eac729fd032/backend/app/main.py#L5314-L5316https://github.com/maziggy/bambuddy/blob/main/CHANGELOG.mdhttps://github.com/maziggy/bambuddy/commit/845ad39b19bf99afeea571c6bae09695777e1460https://github.com/maziggy/bambuddy/releases/tag/v0.2.4.4https://github.com/maziggy/bambuddy/security/advisories/GHSA-6mf4-q26m-47pv