EUVD-2026-78895Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated and network-reachable (PR:N/AV:N), but requires forcing fd exhaustion and racing the transient fail-open window (AC:H); grants full read/write of protected data (C:H/I:H), availability impact incidental.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.4.4, a fail-open in the authentication code allows any attacker to bypass authentication by flooding a public endpoint to exhaust resources causing database access to fail, granting unauthenticated access to all protected endpoints. Version 0.2.4.4 patches the issue.
AnalysisAI
Bambuddy, a self-hosted print archive and management system for Bambu Lab 3D printers, fails open when its database is unavailable: versions from 0.1.6 up to (but not including) 0.2.4.4 catch every exception in the authentication probe and treat the failure as 'auth disabled', granting unauthenticated access to every protected endpoint. A remote attacker with no credentials can force the condition by flooding the public /api/v1/auth/login endpoint until the process exhausts its file-descriptor budget so the next SQLite connect() raises, then timing requests into that transient window to create a persistent admin account or API key, download the database backup (hashed passwords, encryption keys, printer access codes, MFA secrets), alter settings, or control printers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reach to a Bambuddy instance running a version >= 0.1.6 and < 0.2.4.4 with authentication enabled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue backed by concrete source-code evidence (the patch commit 845ad39 modifies the actual auth-decision functions), not a speculative high-CVSS inflation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Bambuddy to version 0.2.4.4 or later, which is the vendor-released patch - it is delivered by commit 845ad39b19bf99afeea571c6bae09695777e1460 (see the GHSA-6mf4-q26m-47pv advisory at https://github.com/maziggy/bambuddy/security/advisories/GHSA-6mf4-q26m-47pv and the release at https://github.com/maziggy/bambuddy/releases/tag/v0.2.4.4) and makes the auth probe fail closed, returning HTTP 503 instead of dispatching protected routes when the database is unreachable. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Bambuddy installations and confirm whether any are running versions 0.1.6 through 0.2.4.3; apply the vendor-released patch to version 0.2.4.4 immediately, and if patching cannot be completed within 24 hours, restrict network access to the /api/v1/auth/login endpoint using a web application firewall or IP allowlisting to prevent resource exhaustion. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-636 – Not Failing Securely ('Failing Open')
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today