CVE-2026-111692
Received Received - Intake

Authentication Bypass in DataBuff ai-apm-web via Hardcoded HMAC Secret

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111692
EUVD
EUVD-2026-102983

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
databufflabs databuff 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

DataBuff ai-apm-web through 0.1.10 has an authentication bypass flaw. Unauthenticated attackers can forge admin session tokens using a hardcoded HMAC secret in JwtTokenService. By signing a payload with the default dev-secret, they can gain full admin access to protected routes, including the Doris SQL query API.

Detection Guidance

Check for unauthenticated access to /webapi routes or Doris SQL query API endpoints. Look for admin session tokens signed with the hardcoded HMAC secret 'dev-secret'. Inspect network traffic for JWT tokens using this secret.

Impact Analysis

Attackers could gain complete administrative control over the system, access sensitive data via the Doris SQL query API, and perform unauthorized actions. This could lead to data breaches, system compromise, or further network infiltration.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face legal penalties, loss of compliance certifications, and reputational damage.

Mitigation Strategies

Upgrade DataBuff ai-apm-web to a version that removes the hardcoded HMAC secret. Rotate all admin session tokens and invalidate existing sessions. Restrict access to /webapi routes and the Doris SQL query API to trusted IPs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111692. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart