DataBuff EUVD-2026-102983

Exploitation requires that the deployment still uses the default hardcoded HMAC secret ('dev-secret') shipped in application.yml and consumed by JwtTokenService - i.e., the operator has not overridden the JWT signing key with a custom strong value - and that the attacker can reach the /webapi routes over the network. The specific limiting factor is configuration: any instance that replaced the default secret with a unique secret is NOT exploitable via this path, since forged tokens would fail signature verification. No valid credentials, user interaction, or local access are needed against a default-secret deployment; the Doris SQL query API is the highest-value protected route reachable once an admin token is forged.

All available signals point to a genuinely high-priority flaw, though some decision inputs are absent. The vendor-provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 9.3 Critical) describes a remote, unauthenticated, low-complexity attack with high confidentiality, integrity, and availability impact and no scope change - consistent with a complete authentication bypass. The root cause (CWE-321, hard-coded HMAC signing key) makes exploitation deterministic rather than probabilistic: the default 'dev-secret' is visible in the public GitHub source (application.yml L54-59, consumed by JwtTokenService L36-60), so any attacker can reproduce the signing key with certainty. No EPSS score was supplied, so statistical exploitation-likelihood cannot be quoted, and there is no CISA KEV listing - thus no confirmed active exploitation. No POC flag was set in the input, but a public technical write-up (hackmd) documents the forging technique in detail, which lowers the practical barrier to weaponization even absent packaged exploit code. The signals are mutually consistent (no CVSS-vs-description conflict), so the main tempering factor is not technical difficulty but deployment footprint: this is an early-stage (v0.1.x) niche product, so real-world exposure is likely limited despite the critical score. Net: treat as high priority wherever this product is internet-reachable, but weigh the small installed base when ranking against other criticals.

An attacker locates an internet-exposed DataBuff ai-apm-web instance still using the default JWT secret, then crafts a JWT with subject 'admin' and a future expiry signed with the publicly-known hardcoded 'dev-secret'. Presenting this forged token grants full administrative access to protected /webapi routes, including the Doris SQL query API, enabling arbitrary data reads and queries. No packaged public exploit is flagged, but a public technical write-up describes the forging method and the secret is readable in the project's source, making exploitation trivial and reliable.