CVE-2026-111693

Summary

The vulnerability is a hard-coded default credential in DataBuff ai-apm-web version 0.1.10 and earlier, allowing unauthenticated attackers to gain full administrator access using the default username 'admin' and password 'Databuff@123'. This creates a critical backdoor that enables attackers to access all protected API endpoints without authentication.

Exploitability

Exploitation is extremely easy with no preconditions required, as attackers simply need to POST the hard-coded credentials to the /webapi/api/v1/auth/login endpoint to obtain an administrator token.

Blast radius

The impact could be severe across all affected systems, as attackers would gain complete administrative control over the application's API endpoints and potentially access sensitive monitoring data and system configurations.

Detection

Monitor for POST requests to /webapi/api/v1/auth/login with username 'admin' and password 'Databuff@123', particularly when these requests result in successful authentication tokens being generated.

Prioritized remediation

Upgrade to version 0.1.11 or later to fix the hard-coded default credentials vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.