CVE-2026-111692
CRITICAL
9,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
CRITICAL
9,8
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
Description
AI Translation Available
DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0061
Percentile
0,5th
Updated
EPSS Score Trend (Last 3 Days)
321
Use of Hard-coded Cryptographic Key
DraftCommon Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism
Gain Privileges Or Assume Identity
Read Application Data
Applicable Platforms
Technologies:
ICS/OT
https://hackmd.io/@hieuPenguinnn/databuff-default-jwt-secret-auth-bypass
https://github.com/databufflabs/databuff
https://github.com/databufflabs/databuff/blob/v0.1.10/ai-apm-web/src/main/java/…
https://github.com/databufflabs/databuff/blob/v0.1.10/ai-apm-web/src/main/java/…
https://github.com/databufflabs/databuff/blob/v0.1.10/ai-apm-web/src/main/resou…
https://hackmd.io/@hieuPenguinnn/databuff-default-jwt-secret-auth-bypass
https://www.vulncheck.com/advisories/databuff-ai-apm-web-through-0.1.10-authent…