CVE-2026-53459: Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints
Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.4.4, a fail-open in the authentication code allows any attacker to bypass authentication by flooding a public endpoint to exhaust resources causing database access to fail, granting unauthenticated access to all protected endpoints. Version 0.2.4.4 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Bambuddyto a version that resolves this vulnerability.Fixed in 0.2.4.4
Event History
Frequently Asked Questions
Which deployments are affected?
Bambuddy versions starting with 0.1.6 and before 0.2.4.4 are affected. Version 0.2.4.4 patches the issue.
What must an attacker do to bypass authentication?
An attacker must be able to flood a public endpoint sufficiently to exhaust resources and cause database access to fail. When that failure occurs, the authentication code fails open and protected endpoints can be accessed without authentication.
Are protected endpoints exposed during the failure condition?
Yes. The described fail-open behavior grants unauthenticated access to all protected endpoints when database access fails as a result of the resource-exhaustion condition.
What is the available remediation?
Upgrade Bambuddy to version 0.2.4.4, which patches the authentication fail-open issue.