CVE-2026-111692 Details
Description
DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.
A vulnerability in DataBuff ai-apm-web versions through 0.1.10 allows unauthenticated attackers to bypass authentication and gain administrative access. This is achieved by exploiting a hardcoded HMAC secret in the JwtTokenService, which is used to sign session tokens. Attackers can forge tokens for the admin account by using the default secret, 'dev-secret', and a future expiration time. Once the token is accepted, the attacker can access protected web API routes, including the Doris SQL query API.
Users should manually set the 'apm.security.jwt.secret' and 'apm.security.seed-password' variables to strong, random values before deploying DataBuff. This will prevent the use of default secrets and passwords, which can be exploited to gain unauthorized access.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-321 | Use of Hard-coded Cryptographic Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DataBuff | <= 0.1.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |