CVE-2026-25505: Bambuddy

Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Prior to version 0.1.7, a hardcoded secret key used for signing JWTs is checked into source code and ManyAPI routes do not check authentication. This issue has been patched in version 0.1.7.

Affected products

• Bambuddy Bambuddy: before 0.1.7 (fixed in 0.1.7)

Published 2026-02-04. Last modified 2026-06-17.