{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/ai-apm-web--0.1.10/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:databuff:ai-apm-web:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-111692"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ai-apm-web (\u003c= 0.1.10)"],"_cs_severities":["critical"],"_cs_tags":["authentication-bypass","jwt","web-application","cve-2026-111692","credential-access","api-security"],"_cs_type":"advisory","_cs_vendors":["DataBuff"],"content_html":"\u003cp\u003eDataBuff ai-apm-web versions 0.1.10 and earlier contain a critical authentication bypass vulnerability (CVE-2026-111692) rooted in the JwtTokenService component. The service utilizes a hardcoded HMAC secret, referred to as 'dev-secret', to sign JSON Web Tokens (JWT). An unauthenticated attacker can leverage this static secret to craft and sign arbitrary session tokens. By setting the token payload to include administrative privileges and a future expiration timestamp, an attacker can bypass all authentication checks. This grants the attacker full administrative access to protected /webapi endpoints, including the Doris SQL query API, facilitating potential unauthorized data access, modification, or further system compromise. The vulnerability is highly severe (CVSS 9.8) because it requires no prior authentication or specialized knowledge of the target environment.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to identify DataBuff ai-apm-web deployments via public-facing services.\u003c/li\u003e\n\u003cli\u003eAttacker interacts with the target /webapi routes to confirm application presence.\u003c/li\u003e\n\u003cli\u003eAttacker retrieves the publicly available source code or identifies the hardcoded 'dev-secret' from the JwtTokenService implementation.\u003c/li\u003e\n\u003cli\u003eAttacker constructs a malicious JWT payload containing 'admin' claims and an extended expiration date.\u003c/li\u003e\n\u003cli\u003eAttacker signs the malicious JWT using the identified 'dev-secret' HMAC key.\u003c/li\u003e\n\u003cli\u003eAttacker submits the forged JWT in the 'Authorization' header of HTTP requests directed at protected /webapi endpoints.\u003c/li\u003e\n\u003cli\u003eDataBuff server validates the forged signature, incorrectly authenticating the request.\u003c/li\u003e\n\u003cli\u003eAttacker gains full administrative control over the application, including the ability to execute arbitrary queries against the Doris SQL API.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full administrative access to the ai-apm-web application. Impacted organizations face risks of data exfiltration from the underlying Doris SQL database, unauthorized modification of application settings, and potential secondary exploitation of the host environment. This vulnerability affects all DataBuff ai-apm-web users running version 0.1.10 or earlier.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch ai-apm-web to a version containing a remediated, non-hardcoded authentication secret immediately.\u003c/li\u003e\n\u003cli\u003eAudit logs for suspicious administrative activity originating from anomalous IP addresses or unexpected sessions using forged JWT signatures.\u003c/li\u003e\n\u003cli\u003eRestrict network access to the /webapi routes to authorized subnets to mitigate exposure to unauthenticated external actors.\u003c/li\u003e\n\u003cli\u003eImplement centralized monitoring for the Doris SQL query API to detect and block unauthorized query patterns.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T18:45:49Z","date_published":"2026-10-16T18:45:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-databuff-auth-bypass/","summary":"An unauthenticated authentication bypass vulnerability (CVE-2026-111692) in DataBuff ai-apm-web allows attackers to forge administrative session tokens using a hardcoded HMAC secret.","title":"Authentication Bypass via Hardcoded HMAC Secret in DataBuff ai-apm-web","url":"https://feed.craftedsignal.io/briefs/2026-10-databuff-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Ai-Apm-Web (\u003c= 0.1.10)","version":"https://jsonfeed.org/version/1.1"}