Bambuddy EUVD-2026-78895

Exploitation requires network reach to a Bambuddy instance running a version >= 0.1.6 and < 0.2.4.4 with authentication enabled. The attacker does not need credentials, but must first induce a database exception during the auth probe - the documented path is flooding the public /api/v1/auth/login endpoint until the process runs out of file descriptors so the next SQLite connect() raises. The auth bypass is only available during that transient fail-open window, and protected-endpoint requests must be timed into it, so the resource-exhaustion prerequisite and timing race are the main practical limiters. Patched instances (0.2.4.4+) return 503 on probe failure and fail closed, eliminating the condition.

This is a genuine high-priority issue backed by concrete source-code evidence (the patch commit 845ad39 modifies the actual auth-decision functions), not a speculative high-CVSS inflation. The vendor CVSS 4.0 vector (9.3, AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:N) and the advisory's stated CVSS 9.8 both mark it critical and unauthenticated. However, the AC:L rating is arguably optimistic: exploitation is not a single clean request - the attacker must first flood /api/v1/auth/login hard enough to exhaust the process's file-descriptor budget so the next SQLite connect() raises, then race protected requests into the transient fail-open window, which in practice raises attack complexity (assessed AC:H). No EPSS score, no CISA KEV listing, and no independent exploit-code artifact are provided in the input; the only exploitation signal is that the reporter (@wondercrash) documented a reproducible PoC methodology in the advisory. So this is 'documented PoC technique exists' rather than confirmed active exploitation - treat the automatable/targeted distinction as unresolved. Once the window is open the impact is severe (full unauthenticated access to every protected endpoint), so the confidentiality/integrity ratings are well-founded; the main calibration caveat is attack complexity, not impact.

An unauthenticated attacker on the network floods the public /api/v1/auth/login endpoint until the Bambuddy process exhausts its file-descriptor budget, causing the next SQLite connection to raise an exception. Because both is_auth_enabled() and the global auth_middleware caught all exceptions and 'failed open,' the attacker then sends token-less requests to protected endpoints during that window and downloads the database backup (hashed passwords, encryption keys, printer access codes, MFA secrets), creates a persistent admin account/API key, or directly controls printers. A reproducible PoC methodology is documented in the vendor advisory (GHSA-6mf4-q26m-47pv), though no standalone weaponized exploit is referenced in the provided data.