Is CVE-2026-111692 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111692?

CVE-2026-111692 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-111692

Description

DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.