Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

bambuddy

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8PyPIAmendedPublished

    Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication

    CVE-2026-25505 · GHSA-gc24-px2r-5qmf

    Affected
    • PyPI bambuddy < 0.1.7
    Fixed in
    0.1.7· Vendor fix available
    Issue
    1. A hardcoded secret key used for signing JWTs is checked into source code 2. ManyAPI routes do not check authentication Details I am using the publicly available docker image at ghcr.io/maziggy/bambuddy 1. Hardcoded JWT Secret Key https://github.com/maziggy/bambuddy/blob/a9bb8ed8239602bf08a9914f85a09eeb2bf13d15/backend/app/core/auth.py#L28 <details <summaryCopying the Authorization token from a request via browser networking tools into JWT.io confirms the token is signed with this key</summary <img width="1591" height="937" alt="image" src="https://github.com/user-attachments/assets/fd6e805a-9380-438f-a412-623660fa3f5a" / </details Any attacker can: 1. Forge valid JWT tokens for any user 2. Bypass authentication entirely 3. Gain full administrative access to any Bambuddy instance using the default key Steps to Reproduce: 1. Run an instance of BamBuddy 2. Create admin user 3. Forge and use JWT: 2. Most API Routes do not check Auth While investigating the JWT forgery, I…

    Recommended action: Upgrade to 0.1.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →