CVE-2026-111692: DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret
DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
DataBuff ai-apm-web versions through 0.1.10 are affected. Any reachable deployment using the hardcoded default JWT HMAC secret is exposed to unauthenticated token forgery.
What does an attacker need to exploit this issue?
The attacker needs network access to the affected ai-apm-web service. No valid account, privileges, or user interaction is required; they can create an admin JWT with a future expiration using the default dev-secret.
What access can a forged token provide?
A forged admin session token provides full administrative access to protected /webapi routes. This includes access to the Doris SQL query API.
How can administrators determine whether they are affected?
Check whether the deployment is DataBuff ai-apm-web 0.1.10 or earlier and whether its JWT configuration still uses the default hardcoded HMAC secret, dev-secret. Such a configuration permits forged admin tokens.