CVE-2026-53459
Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints
CVSS 4.0 9.3 CRITICALCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-53459
PublishedBambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.4.4, a fail-open in the authentication code allows any attacker to bypass authentication by flooding a public endpoint to exhaust resources causing database access to fail, granting unauthenticated access to all protected endpoints. Version 0.2.4.4 patches the issue.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-53459 · CVE overview and exploitation status
cve-program · CVE-2026-53459
- https://github.com/maziggy/bambuddy/security/advisories/GHSA-6mf4-q26m-47pv
- https://github.com/maziggy/bambuddy/commit/845ad39b19bf99afeea571c6bae09695777e1460
- https://github.com/maziggy/bambuddy/blob/449502cc9fc1cec04f06d31512420eac729fd032/backend/app/core/auth.py#L473-L483
- https://github.com/maziggy/bambuddy/blob/449502cc9fc1cec04f06d31512420eac729fd032/backend/app/main.py#L5314-L5316
- https://github.com/maziggy/bambuddy/blob/main/CHANGELOG.md
- https://github.com/maziggy/bambuddy/releases/tag/v0.2.4.4
Related changes
Linked by CVE identifierNo related changes are available here.