DataBuff AI-APM-Web 0.1.10 Has Critical Hardcoded Credential Flaw
Unauthenticated attackers can use default admin credentials to gain full access to the application via a critical vulnerability in versions through 0.1.10.
Key points
- The flaw allows unauthenticated remote attackers to obtain administrator tokens.
- Default credentials are hardcoded as admin and Databuff@123.
- The vulnerability is rated Critical with a CVSS score of 9.3.
The National Vulnerability Database lists CVE-2026-111693 as a critical security flaw affecting DataBuff ai-apm-web through version 0.1.10. This vulnerability stems from hardcoded default credentials that allow unauthenticated attackers to bypass authentication and gain full administrator access to the application without needing valid user credentials.
Attackers can exploit this weakness by sending a POST request to the /webapi/api/v1/auth/login endpoint using the built-in username "admin" and the password "Databuff@123". According to the NVD record, this action grants the attacker an administrator token that provides access to all protected routes within the /webapi directory, effectively compromising the entire application’s administrative functions.
Technical Details and Severity
The vulnerability is classified under CWE-1392, which relates to hardcoded credentials. The Common Vulnerability Scoring System assigns it a base score of 9.3, placing it in the Critical severity range. This score reflects the ease of exploitation and the significant impact of gaining unrestricted administrative control over the system through the use of static, built-in credentials.
The flaw is present in all versions of DataBuff ai-apm-web up to and including 0.1.10. The NVD description specifies that the hardcoded account is built into the software. This makes every installation of these versions vulnerable to the same static credential attack vector, as the credentials are inherent to the application code rather than being set by the user during installation.
Impact on Users
Organizations using DataBuff ai-apm-web for application performance monitoring are at risk if they are running any version prior to the potential patch. The ability to access all protected /webapi routes means an attacker could potentially interact with any functionality available through those endpoints, leveraging the administrator token to perform actions permitted by the application’s API.
The exposure is significant because the attack requires no prior authentication. An attacker with network access to the application can immediately attempt the login with the known default credentials. This allows for direct unauthorized access to the system’s administrative features without the need for complex exploit chains or prior compromise of other systems.
What should you do?
Security teams should immediately audit their environments to identify any instances of DataBuff ai-apm-web running versions 0.1.10 or earlier. If the software is in use, administrators should check if the /webapi/api/v1/auth/login endpoint is exposed to untrusted networks. Until a vendor update is available, restricting network access to the application to trusted IP addresses can reduce the attack surface.
What to do and how to stay safe: DataBuff
- Scan your network for any running instances of DataBuff ai-apm-web to determine if you are using an affected version.
- Verify if the application’s login endpoint is accessible from the public internet and restrict access to internal networks if possible.
- Monitor server logs for failed or successful login attempts using the known default credentials to detect active exploitation.
- Contact the vendor to inquire about the availability of a patch or updated version that removes the hardcoded credentials.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this vulnerability?
The vulnerability is tracked as CVE-2026-111693 in the National Vulnerability Database.
Which versions of DataBuff ai-apm-web are affected?
All versions of DataBuff ai-apm-web through 0.1.10 are affected by this hardcoded credential flaw.
How can an attacker exploit this vulnerability?
Attackers can POST the default credentials admin/Databuff@123 to the /webapi/api/v1/auth/login endpoint to gain administrator access.
