CVE-2026-111692
CRITICAL
CVSS 9.8
Published: 2026-10-16
Modified: 2026-10-16
Tenable Plugin
Checking the public Tenable catalog…
Threat Intelligence Pending
IOCs, MITRE ATT&CK techniques, and attack chain data are being generated. Refresh in a few seconds.
Description
DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.
Quick Facts
| CVE ID | CVE-2026-111692 |
| CVSS Score | 9.8 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2026-10-16 |
| Exploited | No |
| CISA KEV | No |
| PoC | Not public |
References
- https://github.com/databufflabs/databuff
- https://github.com/databufflabs/databuff/blob/v0.1.10/ai-apm…
- https://github.com/databufflabs/databuff/blob/v0.1.10/ai-apm…
- https://github.com/databufflabs/databuff/blob/v0.1.10/ai-apm…
- https://hackmd.io/@hieuPenguinnn/databuff-default-jwt-secret…
- https://www.vulncheck.com/advisories/databuff-ai-apm-web-thr…
- https://hackmd.io/@hieuPenguinnn/databuff-default-jwt-secret…