DataBuff ai-apm-web: Authentication bypass via hardcoded JWT signing secret
Summary
DataBuff ai-apm-web through version 0.1.10 uses a hardcoded default HMAC secret in JwtTokenService to sign session tokens. An unauthenticated remote attacker who knows this secret can forge tokens with admin rights and a future expiry. This grants full administrative access to protected /webapi routes, including the Doris SQL query API.
Affected
- DataBuff ai-apm-web, versions 0 through 0.1.10 (vendor default configuration is unaffected per the CVE record)
Fixed in
Unknown.
Workaround
- Restrict access to the web port (27403 by default) to trusted internal networks or a VPN, and do not expose it to the internet
- Place the platform behind an authenticating reverse proxy or zero-trust access layer
- Check whether the configuration allows overriding the JWT secret; this could not be verified from the sources
- Rotate any credentials or sessions that may have been exposed
Exploitation
- CISA SSVC: exploitation status 'poc', automatable: yes, technical impact: total
- No evidence of active exploitation in the wild found
- No confirmed standalone public exploit found
Our recommendation
- Check whether the DataBuff web port is reachable from the internet and remove that exposure immediately
- Review logs for admin activity on /webapi routes and the Doris SQL API
- Apply the vendor's fixed release as soon as it is published; none is confirmed yet
- Monitor the vendor repository and this tracker for a fix
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-111692 VulnCheck advisory www.vulncheck.com
- DataBuff GitHub repository github.com
- DataBuff v0.1.10 release github.com
- JwtTokenService.java at v0.1.10 github.com
- JwtProperties.java at v0.1.10 github.com
- application.yml at v0.1.10 github.com
- VulDB CVE-2026-111692 vuldb.com
- Strix CVE-2026-111692 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:24.
Original description (NVD)
DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.
NVD references (7)
- https://github.com/databufflabs/databuff
- https://github.com/databufflabs/databuff/blob/v0.1.10/ai-apm-web/src/main/java/com/databuff/apm/web/auth/JwtT…
- https://github.com/databufflabs/databuff/blob/v0.1.10/ai-apm-web/src/main/java/com/databuff/apm/web/config/Jw…
- https://github.com/databufflabs/databuff/blob/v0.1.10/ai-apm-web/src/main/resources/application.yml#L54-L59
- https://hackmd.io/@hieuPenguinnn/databuff-default-jwt-secret-auth-bypass
- https://www.vulncheck.com/advisories/databuff-ai-apm-web-through-0.1.10-authentication-bypass-via-hardcoded-h…
- https://hackmd.io/@hieuPenguinnn/databuff-default-jwt-secret-auth-bypass
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.