CVE-2026-111692

CriticalCVSS 9.8

Published: 16/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 17/10/2026(UTC)NVD NIST

Summary

DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.

Risk Assessment

An unauthenticated attacker can forge admin tokens and gain full access to protected resources, leading to a serious security breach.

Recommendation

Update DataBuff ai-apm-web to a version containing the fix and change the hardcoded HMAC secret.

Other vulnerabilities in DataBuff ai-apm-web

CVE-2026-111693Critical
DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all protected /webapi routes.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS