CyberSecBulletin

Databufflabs vulnerabilities

We track 2 vulnerabilities in Databufflabs products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 16, 2026.

2vulnerabilities
2critical
0high
0exploited
9.8average CVSS score

Latest Databufflabs vulnerabilities

  • 9.8 Critical severity

    databuff: Use of Default Credentials

    CVE-2026-111693Databufflabs

    DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/

  • 9.8 Critical severity

    databuff: Use of Hard-coded Cryptographic Key

    CVE-2026-111692Databufflabs

    DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future exp