What is the CVSS score of CVE-2026-25505?

CVE-2026-25505 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Bambuddy are affected by CVE-2026-25505?

Bambuddy versions 0.1.7 and earlier contain a critical authentication bypass vulnerability (CVSS 9.8) that allows unauthenticated attackers to access sensitive functions.. A patch is available.

Is there a public PoC exploit available for CVE-2026-25505?

Yes, a public proof-of-concept exploit is available for CVE-2026-25505. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-25505?

Within 24 hours: Identify all systems running Bambuddy 0.1.7 or earlier and isolate them from production networks if possible. Within 7 days: Apply the available vendor patch to all affected systems and validate successful deployment. Within 30 days: Conduct a security audit to confirm patch compliance across all environments and review access logs for any signs of exploitation.

Bambuddy CVE-2026-25505

CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-02-04 security-advisories@github.com

GHSA-gc24-px2r-5qmf

Authentication Bypass Bambuddy

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 27, 2026 - 20:25 vuln.today

Public exploit code

Patch released

Feb 27, 2026 - 20:25 nvd

Patch available

CVE Published

Feb 04, 2026 - 20:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Prior to version 0.1.7, a hardcoded secret key used for signing JWTs is checked into source code and ManyAPI routes do not check authentication. This issue has been patched in version 0.1.7.

AnalysisAI

Bambuddy 3D printer management system has missing authentication (CVSS 9.8) allowing unauthenticated access to printer control and print archive.

Technical ContextAI

Bambuddy, a self-hosted print archive for Bambu Lab 3D printers, has a CWE-306 missing authentication vulnerability allowing unauthenticated access to printer management functions.