CVE-2026-111692

CRITICAL 9.8

DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.

CWE	CWE-321
Vendor	databufflabs
Product	databuff
Published	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for databufflabs databuff

Be the first to know when new critical vulnerabilities affecting databufflabs databuff are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

databufflabs / databuff

0 ≤ 0.1.10

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@hieuPenguinnn/databuff-default-jwt-secret-auth-bypass github.com: https://github.com/databufflabs/databuff/blob/v0.1.10/ai-apm-web/src/main/resources/application.yml#L54-L59 github.com: https://github.com/databufflabs/databuff/blob/v0.1.10/ai-apm-web/src/main/java/com/databuff/apm/web/config/JwtProperties.java#L8-L15 github.com: https://github.com/databufflabs/databuff/blob/v0.1.10/ai-apm-web/src/main/java/com/databuff/apm/web/auth/JwtTokenService.java#L36-L60 github.com: https://github.com/databufflabs/databuff vulncheck.com: https://www.vulncheck.com/advisories/databuff-ai-apm-web-through-0.1.10-authentication-bypass-via-hardcoded-hmac-secret

Credits

hieuPenguinnn