CVE-2026-111692 — DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret
DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMA…
Published: 2026-10-16 · CVSS: 9.3 · CVSS 4.0
DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7