External risk intelligence

DataBuff ai-apm-web Authentication Bypass via Hardcoded HMAC Secret.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-111692

The vulnerability affects a web application (ai-apm-web) and specifically targets administrative web API routes, including an SQL query API. Such application components are commonly deployed as internet-facing web services or APIs to facilitate remote monitoring and management, making them reachable in typical network-exposed deployments.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in DataBuff ai-apm-web allows unauthorized access to administrative functions, including SQL query capabilities, by exploiting a hardcoded secret. This could potentially enable malicious actors to gain full control over protected routes within the application.

Unauthenticated attackers can bypass security.
This impacts administrative access and data queries.
Verify if this product is in use.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication by exploiting a hardcoded secret used for signing administrative session tokens. This allows them to create their own valid tokens, granting them full administrative access to protected web routes, including those that can execute SQL queries.

No authentication required.
Forge admin session tokens using hardcoded secret.
Gain full administrative access.

Live Threat

Current exploitation, exposure, and threat context

The DataBuff ai-apm-web service could allow unauthenticated attackers to gain administrative access to protected routes, including those that query SQL data. This is possible by forging admin session tokens using a hardcoded secret.

Administrative access to web APIs.
Unauthenticated forging of admin tokens.
Unauthorized access to sensitive data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical authentication bypass vulnerability in DataBuff ai-apm-web impacts systems with administrative access, potentially exposing sensitive data and operations through forged session tokens. Responsibility likely lies with application owners and platform teams who manage the DataBuff deployment, in coordination with security teams for exposure review. The immediate first step is to inventory all instances of DataBuff ai-apm-web, confirm their reachability and business criticality, and identify the accountable system owner to plan a risk-based remediation strategy.

Application owners should manage remediation.
Verify external reachability and business criticality.
Plan mitigation based on asset criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is DataBuff ai-apm-web?

DataBuff ai-apm-web is a web-based application designed for monitoring and managing AI-driven application performance. It includes backend API routes for administrative functions, such as interacting with a Doris SQL query API to retrieve or manipulate system data.

What does CWE-321 mean for CVE-2026-111692?

CWE-321 refers to the use of a hardcoded cryptographic key. In this specific CVE, the application uses a default, hardcoded HMAC secret within its token service. This allows anyone who knows the secret to cryptographically sign their own session tokens as an administrator, effectively bypassing the login process.

How can an attacker trigger this authentication bypass?

An attacker triggers the bug by crafting a session token signed with the application's default dev-secret. Because the secret is hardcoded, no specific user interaction or pre-existing account is needed to generate a valid-looking admin token. Simply visiting the application's protected web API routes with this forged token grants full access; actions performed while logged in legitimately do not trigger this vulnerability.

Why should I care about this if my DataBuff instance is internal?

Halo Surface Signal indicates that ai-apm-web is frequently deployed as an internet-facing service to support remote monitoring. While an internal deployment reduces the immediate pool of attackers, the vulnerability remains critical; if any actor inside your network reaches the administrative web routes, they can exploit the hardcoded secret just as easily as an external threat.

How do I start addressing this vulnerability?

Begin by inventorying your environment to locate all running instances of DataBuff ai-apm-web. Confirm which instances are reachable over your network and identify the system owners responsible for those deployments. Prioritize these assets based on their business criticality to coordinate a remediation plan with your security team.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.