DataBuff ai-apm-web Authentication Bypass Allows Admin Token Forgery

DataBuff ai-apm-web versions through 0.1.10 contain a critical authentication bypass vulnerability identified as CVE-2026-111692. According to the National Vulnerability Database, this flaw allows unauthenticated attackers to forge administrative session tokens. The vulnerability exists because the application uses a hardcoded HMAC secret within the JwtTokenService module. This design choice enables attackers to generate valid tokens without possessing legitimate credentials.

The risk

The core issue involves the use of a default development secret for signing JSON Web Tokens. Attackers can utilize this hardcoded value to sign arbitrary payloads. By setting an admin role and a future expiry time, they can create tokens that the application accepts as valid. This grants full administrative access to protected endpoints. Specifically, the vulnerability exposes the /webapi routes. Among these, the Doris SQL query API is accessible, potentially allowing data manipulation or extraction.

Who is exposed

Organizations running DataBuff ai-apm-web versions 0.1.10 or earlier are exposed to this risk. The vulnerability affects the authentication mechanism itself, meaning no initial login is required for exploitation. Any instance accessible to the attacker can be targeted. The exposure is not limited by user permissions since the token forgery bypasses standard access controls. Environments relying on this specific version for application performance monitoring remain vulnerable.

Cost and compliance

The National Vulnerability Database rates the severity of CVE-2026-111692 as Critical. The Common Vulnerability Scoring System assigns it a score of 9.3. This high score reflects the ease of exploitation and the significant impact on confidentiality and integrity. The weakness is categorized under CWE-321. No financial impact figures are provided in the source material.

What to watch

Security teams should verify if their infrastructure runs affected versions of DataBuff ai-apm-web. Check for any unauthorized administrative access attempts in web server logs. Monitor for unusual activity on the Doris SQL query API endpoints. Ensure that network segmentation limits access to these sensitive interfaces. Review token validation logic for other applications to prevent similar hardcoded secret issues.

Signals worth monitoring

Teams usually detect this type of activity by reviewing authentication logs for tokens with unexpected signatures or origins. Check whether web application firewalls flag requests containing forged JSON Web Tokens with admin claims. Look for sudden spikes in access to protected /webapi routes from untrusted IP addresses. Monitor for successful authentication events that lack corresponding user login records. Verify that token expiry times align with standard policy expectations.

Background: Authentication bypass vulnerabilities

Authentication bypass vulnerabilities arise from logic flaws, improper session handling, and misconfigured permissions. These mistakes let attackers access data without valid credentials. Fixing them requires strict input validation, secure session management, and regular vulnerability scanning to identify weak points before exploitation.

Read the full guide: Authentication Bypass Mistakes That Leave Systems Exposed

What to do and how to stay safe: DataBuff

• Audit all instances of DataBuff ai-apm-web to identify versions 0.1.10 or older and isolate them from untrusted networks.
• Review server logs for unauthorized access to administrative endpoints, particularly the Doris SQL query API, to detect exploitation.
• Implement strict network segmentation to restrict access to /webapi routes, ensuring only trusted internal services can communicate with them.
• Once the vendor provides an update, apply it immediately to resolve the hardcoded secret vulnerability and restore proper authentication controls.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-111692?

The National Vulnerability Database assigns a CVSS score of 9.3 to this vulnerability, rating it as Critical.

Which DataBuff ai-apm-web versions are affected?

All versions of DataBuff ai-apm-web through 0.1.10 are affected by this authentication bypass vulnerability.

How do attackers exploit this flaw?

Attackers use the hardcoded HMAC secret in JwtTokenService to sign forged admin tokens with future expiry dates.