{"id":"CVE-2026-53459","state":"PUBLISHED","title":"Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints","description":"Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.4.4, a fail-open in the authentication code allows any attacker to bypass authentication by flooding a public endpoint to exhaust resources causing database access to fail, granting unauthenticated access to all protected endpoints. Version 0.2.4.4 patches the issue.","publishedAt":"2026-09-15T17:25:27.247Z","updatedAt":"2026-09-17T16:30:18.884Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["maziggy bambuddy"],"affected":[{"vendor":"maziggy","product":"bambuddy","versions":[{"version":">= 0.1.6, < 0.2.4.4","status":"affected"}]}],"references":["https://github.com/maziggy/bambuddy/security/advisories/GHSA-6mf4-q26m-47pv","https://github.com/maziggy/bambuddy/commit/845ad39b19bf99afeea571c6bae09695777e1460","https://github.com/maziggy/bambuddy/blob/449502cc9fc1cec04f06d31512420eac729fd032/backend/app/core/auth.py#L473-L483","https://github.com/maziggy/bambuddy/blob/449502cc9fc1cec04f06d31512420eac729fd032/backend/app/main.py#L5314-L5316","https://github.com/maziggy/bambuddy/blob/main/CHANGELOG.md","https://github.com/maziggy/bambuddy/releases/tag/v0.2.4.4"],"weaknesses":["CWE-636","CWE-755"],"ingestedAt":"2026-10-29T20:12:16.098Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/53xxx/CVE-2026-53459.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-53459","state":"PUBLISHED","datePublished":"2026-09-15T17:25:27.247Z","dateUpdated":"2026-09-17T16:30:18.884Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-06-09T16:31:21.495Z"},"containers":{"cna":{"title":"Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints","descriptions":[{"lang":"en","value":"Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.4.4, a fail-open in the authentication code allows any attacker to bypass authentication by flooding a public endpoint to exhaust resources causing database access to fail, granting unauthenticated access to all protected endpoints. Version 0.2.4.4 patches the issue."}],"affected":[{"vendor":"maziggy","product":"bambuddy","versions":[{"version":">= 0.1.6, < 0.2.4.4","status":"affected"}]}],"references":[{"url":"https://github.com/maziggy/bambuddy/security/advisories/GHSA-6mf4-q26m-47pv","name":"https://github.com/maziggy/bambuddy/security/advisories/GHSA-6mf4-q26m-47pv","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/maziggy/bambuddy/commit/845ad39b19bf99afeea571c6bae09695777e1460","name":"https://github.com/maziggy/bambuddy/commit/845ad39b19bf99afeea571c6bae09695777e1460","tags":["x_refsource_MISC"]},{"url":"https://github.com/maziggy/bambuddy/blob/449502cc9fc1cec04f06d31512420eac729fd032/backend/app/core/auth.py#L473-L483","name":"https://github.com/maziggy/bambuddy/blob/449502cc9fc1cec04f06d31512420eac729fd032/backend/app/core/auth.py#L473-L483","tags":["x_refsource_MISC"]},{"url":"https://github.com/maziggy/bambuddy/blob/449502cc9fc1cec04f06d31512420eac729fd032/backend/app/main.py#L5314-L5316","name":"https://github.com/maziggy/bambuddy/blob/449502cc9fc1cec04f06d31512420eac729fd032/backend/app/main.py#L5314-L5316","tags":["x_refsource_MISC"]},{"url":"https://github.com/maziggy/bambuddy/blob/main/CHANGELOG.md","name":"https://github.com/maziggy/bambuddy/blob/main/CHANGELOG.md","tags":["x_refsource_MISC"]},{"url":"https://github.com/maziggy/bambuddy/releases/tag/v0.2.4.4","name":"https://github.com/maziggy/bambuddy/releases/tag/v0.2.4.4","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-636","lang":"en","description":"CWE-636: Not Failing Securely ('Failing Open')","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-755","lang":"en","description":"CWE-755: Improper Handling of Exceptional Conditions","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-09-15T17:25:27.247Z"},"source":{"advisory":"GHSA-6mf4-q26m-47pv","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-17T16:30:00.814754Z","id":"CVE-2026-53459","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-17T16:30:18.884Z"}}]}}}