CVE-2026-53459
Received Received - Intake

Authentication Bypass in Bambuddy via Resource Exhaustion

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.4.4, a fail-open in the authentication code allows any attacker to bypass authentication by flooding a public endpoint to exhaust resources causing database access to fail, granting unauthenticated access to all protected endpoints. Version 0.2.4.4 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-53459
EUVD
EUVD-2026-78895

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bambuddy bambuddy From 0.1.6 (inc) to 0.2.4.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-755 The product does not handle or incorrectly handles an exceptional condition.
CWE-636 When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in Bambuddy, a 3D printer management system. It allows attackers to gain unauthorized access to protected endpoints by flooding the login endpoint to cause database errors. The system then incorrectly allows requests as if authentication were disabled, granting full access to sensitive functions like admin account creation and printer control.

Detection Guidance

Monitor for unusual authentication bypass attempts by checking logs for repeated failed login attempts to the /api/v1/auth/login endpoint. Look for HTTP 503 responses during normal operations, which may indicate database errors triggering the fail-open state. Inspect API key usage for unauthorized administrative actions.

Impact Analysis

An attacker could exploit this to create admin accounts, generate API keys, download sensitive data like passwords and printer access codes, modify system settings, or control connected 3D printers without authorization. The impact includes data breaches, unauthorized system control, and potential physical device manipulation.

Mitigation Strategies

Upgrade Bambuddy to version 0.2.4.4 or later immediately. Block external access to the /api/v1/auth/login endpoint temporarily if possible. Review logs for signs of exploitation and revoke any unauthorized API keys or admin accounts created during the vulnerability window.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53459. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart