Executive brief
Bambuddy is a self-hosted print archive system for managing Bambu Lab 3D printers. A flaw in its authentication system allows unauthenticated attackers to bypass login by flooding a public endpoint with requests, causing the database to fail and granting full access to all protected data and functionality. This could enable unauthorized users to view, modify, or delete print records and configurations.
Technical details
The vulnerability is a fail-open authentication bypass in Bambuddy's core authentication module (auth.py). When an attacker floods the public endpoint with requests to exhaust system resources, the database connection fails, causing the authentication check to default to an open/allow state rather than a secure deny. This affects versions 0.1.6 through 0.2.4.3. The attack requires network access to the public endpoint but no authentication credentials or user interaction. Version 0.2.4.4 patches this vulnerability by fixing the fail-close behavior in the authentication code.
Affected products
- maziggy Bambuddy 0.1.6 to 0.2.4.3
Timeline
- 2026-09-15: disclosed
- 0.2.4.4: patched