CVE-2026-25505: 
Python vulnerability analysis and mitigation

CVE-2026-25505 is a critical vulnerability in Bambuddy, a self-hosted print archive and management system for Bambu Lab 3D printers, combining a hardcoded JWT secret key (CWE-321) with missing authentication on the majority of API routes (CWE-306). All versions prior to 0.1.7 are affected. The vulnerability was published on February 4, 2026, and a patch was released in version 0.1.7. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Red Hat CVE).

The root cause is twofold: first, the JWT signing secret "bambuddy-secret-key-change-in-production" was hardcoded in backend/app/core/auth.py at line 28 (CWE-321), making it trivially known to any attacker who inspects the public source code or Docker image. Second, the vast majority of API routes — 77 out of 117 tested GET endpoints, plus POST endpoints — lacked any authentication dependency, meaning requests with no Authorization header returned sensitive data (CWE-306). An attacker can exploit either flaw independently: forge a valid HS256 JWT for any username using the known secret, or simply omit authentication headers entirely to access most endpoints. No preconditions such as an existing account or network proximity are required — only network access to the Bambuddy instance (GitHub Advisory, Patch Commit).

Successful exploitation grants an unauthenticated remote attacker full read and write access to the Bambuddy instance, including print archives, filament data, user lists, API keys, system settings, cloud credentials, printer status, notification configurations, GitHub backup settings, and support logs. An attacker can also create new API keys with full permissions (queue, printer control, status read) without any authentication, enabling persistent access even after a password change. The combined confidentiality, integrity, and availability impact is rated High across all three dimensions, reflecting the potential for complete system compromise of the 3D printer management platform (GitHub Advisory).

A public proof-of-concept script is included in the GitHub Security Advisory, demonstrating both JWT forgery and unauthenticated API access across 117 endpoints. The PoC uses the Python jwt library to forge tokens with the hardcoded secret and tests all API routes. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.108%, reflecting low but non-zero exploitation probability (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing or LAN-accessible Bambuddy instances (default port 8000) running versions prior to 0.1.7 using network scanners or Shodan. Confirm the version via the unauthenticated /api/v1/updates/version or /api/v1/system/info endpoints.
2. Unauthenticated data access: Send HTTP GET requests to any of the 77+ unprotected endpoints (e.g., /api/v1/system/info, /api/v1/settings, /api/v1/archives/, /api/v1/api-keys/) with no Authorization header to retrieve sensitive data without any credentials.
3. JWT forgery (for auth-required endpoints): Using the publicly known hardcoded secret "bambuddy-secret-key-change-in-production", forge a valid HS256 JWT: import jwt; token = jwt.encode({"sub": "admin", "exp": 9999999999}, "bambuddy-secret-key-change-in-production", algorithm="HS256")
4. Access privileged endpoints: Use the forged JWT as a Bearer token to access endpoints requiring authentication, such as /api/v1/users, /api/v1/printers/1, and /api/v1/groups.
5. Establish persistence: Issue a POST request to /api/v1/api-keys/ with no authentication to create a new API key with full permissions (can_queue, can_control_printer, can_read_status), obtaining a persistent access credential: curl 'http://<target>:8000/api/v1/api-keys/' -X POST -H 'Content-Type: application/json' --data-raw '{"name":"backdoor","can_queue":true,"can_control_printer":true,"can_read_status":true}'
6. Achieve objectives: Use the obtained API key or forged JWT to read print archives, exfiltrate cloud credentials, modify settings, or control connected Bambu Lab printers (GitHub Advisory).

• Network: Unexpected HTTP GET or POST requests to /api/v1/api-keys/, /api/v1/system/info, /api/v1/settings, /api/v1/support/logs, or /api/v1/github-backup/config from unknown source IPs, particularly with no Authorization header.
• Network: HTTP POST to /api/v1/api-keys/ without an Authorization header resulting in a 200/201 response, indicating unauthorized API key creation.
• Logs: Bambuddy access logs showing successful (HTTP 200) responses to sensitive endpoints from IPs not associated with legitimate users, especially without authentication headers.
• Logs: Presence of JWT tokens signed with the hardcoded secret "bambuddy-secret-key-change-in-production" in access logs (identifiable by decoding the token at jwt.io and checking the signature).
• File System / Database: Unexpected new API keys in the database with names not created by legitimate administrators, or API keys with all permissions enabled (can_queue=true, can_control_printer=true, can_read_status=true).
• Application: Unexplained changes to system settings, notification templates, or cloud configuration that were not initiated by known administrators (GitHub Advisory).

Upgrade Bambuddy to version 0.1.7 or later, which removes the hardcoded JWT secret and adds authentication enforcement to 200+ API endpoints via HTTP middleware. The fix loads the JWT secret from the JWT_SECRET_KEY environment variable, a .jwt_secret file, or auto-generates a cryptographically secure 64-byte random secret. Note that upgrading will invalidate all existing JWT tokens, requiring users to re-login. For deployments unable to patch immediately, implement network-level access controls (firewall rules, VPN, or reverse proxy with authentication) to restrict access to the Bambuddy API to trusted networks only, and audit the database for unauthorized API keys (GitHub Advisory, Patch Commit, PR #225).

The vulnerability was reported by a researcher identified as "Speenah" via GitHub's private security advisory process and was addressed promptly by the maintainer (maziggy) in a dedicated security release (v0.1.6.2/v0.1.7). The CISA vulnerability bulletin for the week of February 2, 2026 included this CVE. Coverage appeared on The Hacker Wire and was included in PoC-week digests, reflecting moderate community interest given the niche but self-hosted nature of the software (CISA Bulletin, The Hacker Wire).