CVE-2026-111693 debrief based on the supplied source corpus. The CVE record was published on 2026-10-16T17:39:48.920Z and has not been modified since then. The vulnerability affects DataBuff ai-apm-web through 0.1.10, allowing unauthenticated attackers to gain administrator access using hard-coded default credentials. Defenders should assess exposure and prioritize remediation. The CVE record and source i [truncated]
CVE-2026-111692 is a critical authentication bypass vulnerability in DataBuff ai-apm-web through version 0.1.10. The vulnerability allows unauthenticated attackers to forge admin session tokens using a hardcoded HMAC secret in JwtTokenService. This can grant full administrative access to protected /webapi routes, including the Doris SQL query API. System administrators and security teams should assess exp [truncated]
