DataBuff ai-apm-web Authentication Bypass Grants Admin Access via Hardcoded Secret

DataBuff ai-apm-web contains a critical authentication bypass vulnerability that allows unauthenticated attackers to gain full administrative access. The flaw, tracked as CVE-2026-111692, stems from a hardcoded HMAC secret within the application's JwtTokenService component.

According to the National Vulnerability Database, the issue carries a CVSS score of 9.3, classifying it as Critical. The weakness is categorized under CWE-321, which relates to the generation of insecure cryptographic keys. This high severity rating reflects the ease with which an attacker can exploit the flaw to assume privileged roles without valid credentials.

Technical Details of the Vulnerability

The vulnerability allows attackers to forge administrative session tokens by leveraging a hardcoded secret key. Instead of using a unique, secure secret for each deployment, the application relies on a default developer secret. Attackers can use this known secret to sign a payload that claims administrative privileges and sets a future expiration time.

This forged token is accepted by the application as valid. Consequently, the attacker gains full administrative access to protected /webapi routes. This includes access to the Doris SQL query API, which could allow for further data extraction or manipulation depending on the API's capabilities.

Affected Versions and Scope

The vulnerability affects DataBuff ai-apm-web versions up to and including 0.1.10. Any installation running these versions is potentially exposed to unauthorized administrative access. The flaw is inherent in the application's design, specifically within the JwtTokenService, rather than being a configuration error introduced by the user.

There is no mention of a patch or update in the available source material. Until the vendor provides a fix, systems running affected versions remain vulnerable. Users should assume that any instance of the software through version 0.1.10 is at risk of exploitation by unauthenticated parties.

What should you do?

Organizations should immediately audit their environments for installations of DataBuff ai-apm-web. If affected versions are present, consider isolating the application from untrusted networks to reduce the attack surface. Monitor logs for unusual administrative activity or token generation patterns that may indicate exploitation.

What to do and how to stay safe: DataBuff

• Inventory all systems to identify if DataBuff ai-apm-web versions through 0.1.10 are deployed in production or development environments.
• Implement network segmentation or firewall rules to restrict access to the /webapi endpoints, limiting exposure to untrusted networks.
• Monitor application logs for signs of unauthorized administrative access or unusual token usage patterns that could indicate exploitation.
• Contact the vendor to inquire about the status of a patch or mitigation guidance, and apply updates once they become available.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-111692?

It is a critical authentication bypass vulnerability in DataBuff ai-apm-web that allows attackers to forge admin tokens using a hardcoded secret.

Which versions of DataBuff ai-apm-web are affected?

All versions through 0.1.10 are affected by this vulnerability.

Is there a fix available for this vulnerability?

No fix has been confirmed yet according to the source material.