Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M

CVE-2026-53459Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints

Critical 9.3

In plain English

A critical-severity security flaw in bambuddy from maziggy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.8%top 44.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.4.4, a fail-open in the authentication code allows any attacker to bypass authentication by flooding a public endpoint to exhaust resources causing database access to fail, granting unauthenticated access to all protected endpoints. Version 0.2.4.4 patches the issue.

Affected products (as reported)

Vendor	Product	Versions
maziggy	bambuddy	>= 0.1.6, < 0.2.4.4

Weakness: CWE-636, CWE-755 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/maziggy/bambuddy/security/advisories/GHSA-6mf4-q26m-47pv x_refsource_CONFIRM
https://github.com/maziggy/bambuddy/commit/845ad39b19bf99afeea571c6bae09695777e1460 x_refsource_MISC
https://github.com/maziggy/bambuddy/blob/449502cc9fc1cec04f06d31512420eac729fd032/backend/app/core/auth.py#L473-L483 x_refsource_MISC
https://github.com/maziggy/bambuddy/blob/449502cc9fc1cec04f06d31512420eac729fd032/backend/app/main.py#L5314-L5316 x_refsource_MISC
https://github.com/maziggy/bambuddy/blob/main/CHANGELOG.md x_refsource_MISC
https://github.com/maziggy/bambuddy/releases/tag/v0.2.4.4 x_refsource_MISC