databuff vulnerabilities

2 known vulnerabilities in databuff from Databufflabs. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  databuff: Use of Default Credentials

  CVE-2026-111693Oct 16, 2026Databufflabs

  DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/

• 9.8 Critical severity

  databuff: Use of Hard-coded Cryptographic Key

  CVE-2026-111692Oct 16, 2026Databufflabs

  DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future exp