Databuff CVEs and Security Vulnerabilities

CVE-2026-111693

DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials

DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all protected /webapi routes.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Databufflabs

Products

Databuff

CVE-2026-111692

DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret

DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.