External risk intelligence

DataBuff ai-apm-web Default Credentials Authentication Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-111693

The vulnerability exists in a web application (ai-apm-web) and involves an authentication endpoint (/webapi/api/v1/auth/login). Such applications are commonly deployed as network-accessible services to provide administrative or monitoring capabilities, making them likely to be reachable from the internet or exposed within an organization's network perimeter.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in DataBuff ai-apm-web related to hard-coded default administrator credentials, which could allow unauthorized access to sensitive system functions.

Default credentials allow unauthorized admin access.
Critical systems could be compromised by attackers.
Confirm relevance and exposure for affected systems.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a POST request to the `/webapi/api/v1/auth/login` endpoint with hard-coded default credentials. This grants them administrator privileges, allowing them to access all protected routes within the `/webapi` API.

Unauthenticated network access required.
Default credentials trigger administrator access.
Full administrative control over protected routes.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to gain administrator access to the ai-apm-web application by using hard-coded default credentials. This access could then be used to interact with all protected web API routes.

Administrator access to protected routes.
Unauthenticated login via default credentials.
Unauthorized access and control of application functions.

Operational Fix

Recommended remediation, mitigation, and detection steps

The DataBuff ai-apm-web application's hard-coded default credentials create a critical risk, potentially allowing unauthenticated administrator access. Infrastructure and platform teams are likely responsible for managing this technology, and their first step should be to locate all instances of DataBuff ai-apm-web within the environment, confirm its exposure and business criticality, and identify the accountable system owner. Subsequent remediation planning should be risk-based, considering factors like vendor coordination and the impact of patching within maintenance windows.

Identify and confirm accountable owners.
Verify external exposure and business impact.
Plan vendor-assisted remediation strategy.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is DataBuff ai-apm-web?

DataBuff ai-apm-web is an application performance monitoring tool. It is typically used by development and operations teams to track, analyze, and manage the health and efficiency of their software services, often acting as a central dashboard for backend performance metrics.

What does hard-coded credentials mean for CVE-2026-111693?

This vulnerability, classified as Use of Default Credentials (CWE-1392), means the software has a built-in administrative account with a password permanently embedded in the code. Because this password cannot be changed by users, anyone who knows the standard credential can bypass security and gain full administrator privileges.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending a specific web request to the application's login endpoint. It does not require any prior user account or special permissions to work. Simply submitting the known default admin username and password to the API allows the attacker to receive an administrator token, granting them full access to protected system functions.

Is my environment at risk from this CVE?

If you host this software, it is a concern. According to Halo Surface Signal, because this component provides administrative and monitoring features, it is often placed on network-accessible segments. If your instances are reachable over the internet or even within your internal network, they are likely exposed to this unauthorized access risk.

How should I respond to this threat?

Start by auditing your infrastructure to locate all active installations of DataBuff ai-apm-web. Once identified, determine who is responsible for managing these specific systems and assess their network accessibility. Work with those system owners to prioritize remediation based on the sensitivity of the data handled by the application.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.