databufflabs vulnerabilities

Products

• databufflabs/databuff 2

Latest databufflabs CVEs

Newest publication first

1. CVE-2026-111692 DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret

   Published 2026-10-16

   Critical·CVSS 9.3 EPSS 0.61%

   DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default...

2. CVE-2026-111693 DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials

   Published 2026-10-16

   Critical·CVSS 9.3 EPSS 0.50%

   DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.