CVE-2026-53459
- Source
- https://cve.org/CVERecord?id=CVE-2026-53459
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53459.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-53459
- Aliases
-
- GHSA-6mf4-q26m-47pv
- Published
- 2026-09-15T17:25:27Z
- Modified
- 2026-10-28T02:31:06Z
- Severity
-
- 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints
- Details
-
Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.4.4, a fail-open in the authentication code allows any attacker to bypass authentication by flooding a public endpoint to exhaust resources causing database access to fail, granting unauthenticated access to all protected endpoints. Version 0.2.4.4 patches the issue.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-636", "CWE-755" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53459.json" }- References
-
- https://github.com/maziggy/bambuddy/blob/449502cc9fc1cec04f06d31512420eac729fd032/backend/app/core/auth.py#L473-L483
- https://github.com/maziggy/bambuddy/blob/449502cc9fc1cec04f06d31512420eac729fd032/backend/app/main.py#L5314-L5316
- https://github.com/maziggy/bambuddy/blob/main/CHANGELOG.md
- https://github.com/maziggy/bambuddy/releases/tag/v0.2.4.4
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53459.json
- https://github.com/maziggy/bambuddy/security/advisories/GHSA-6mf4-q26m-47pv
- https://nvd.nist.gov/vuln/detail/CVE-2026-53459
- https://github.com/maziggy/bambuddy/commit/845ad39b19bf99afeea571c6bae09695777e1460
Affected packages
Git / github.com/maziggy/bambuddy
Affected ranges
- Type
- GIT
- Repo
- https://github.com/maziggy/bambuddy
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0.1.6" }, { "fixed": "0.2.4.4" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "845ad39b19bf99afeea571c6bae09695777e1460" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v0.2.4.4", "range": [ { "fixed": "0967f9758bf806131a3fcde54aa054c9b31e0ad7" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
v0.*
v0.1.6
v0.1.6-hotfix
v0.1.6.1
v0.1.6.2
v0.1.6b
v0.1.6b10
v0.1.6b11
v0.1.6b2
v0.1.6b3
v0.1.6b4
v0.1.6b5
v0.1.6b6
v0.1.6b7
v0.1.6b8
v0.1.6b9
v0.1.7
v0.1.8
v0.1.8.1
v0.1.9
v0.2.0
v0.2.1
v0.2.1.1
v0.2.1b3
v0.2.2
v0.2.2-b1
v0.2.2-b2
v0.2.2.1
v0.2.2.2
v0.2.2b1
v0.2.2b2
v0.2.2b3
v0.2.2b3-daily.20260312
v0.2.2b4-daily.20260313
v0.2.2b4-daily.20260314
v0.2.3
v0.2.3.1
v0.2.3.2
v0.2.3b1-daily.20260316
v0.2.3b1-daily.20260317
v0.2.3b1-daily.20260318
v0.2.3b1-daily.20260401
v0.2.3b1-daily.20260407
v0.2.3b3-daily.20260409
v0.2.4
v0.2.4.1
v0.2.4.2
v0.2.4.3
v0.2.4b1
v0.2.4b3
v0.2.5b1-daily.20260511
v0.2.5b1-daily.20260512
v0.2.5b1-daily.20260513
v0.2.5b1-daily.20260514
v0.2.5b1-daily.20260515
v0.2.5b1-daily.20260516
v0.2.5b1-daily.20260517
v0.2.5b1-daily.20260518
v0.2.5b1-daily.20260519
v0.2.5b1-daily.20260520
v0.2.5b1-daily.20260521
v0.2.5b1-daily.20260522
v0.2.5b1-daily.20260523