Skip to content
OpenAdvisories

Product · databufflabs

databuff

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-111692

    DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret

    DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future ex…

    databufflabs databuff
  • Critical 9.8
    CVE-2026-111693

    DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials

    DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1…

    databufflabs databuff