{"action":"Upgrade bambuddy to 0.1.7 or later.","affected":[{"fixed":"0.1.7","introduced":"0"}],"component":"bambuddy","cve_ids":["CVE-2026-25505"],"ecosystem":"PyPI","epss":0.00822,"exploited":false,"fixed_versions":["0.1.7"],"ghsa_id":"GHSA-gc24-px2r-5qmf","id":"tcs_01M5KFHBK1SGN2V4WJJMJ2AHVG","modified_at":"2026-02-06T22:17:18.435659Z","published_at":"2026-02-02T21:21:14Z","references":["https://osv.dev/vulnerability/GHSA-gc24-px2r-5qmf","https://github.com/maziggy/bambuddy/security/advisories/GHSA-gc24-px2r-5qmf","https://nvd.nist.gov/vuln/detail/CVE-2026-25505","https://github.com/maziggy/bambuddy/pull/225","https://github.com/maziggy/bambuddy/commit/a82f9278d2d587b7042a0858aab79fd8b6e3add9","https://github.com/maziggy/bambuddy/commit/c31f2968889c855f1ffacb700c2c9970deb2a6fb","https://github.com/maziggy/bambuddy","https://github.com/maziggy/bambuddy/blob/a9bb8ed8239602bf08a9914f85a09eeb2bf13d15/backend/app/core/auth.py#L28","https://github.com/maziggy/bambuddy/blob/main/CHANGELOG.md","https://github.com/maziggy/bambuddy/releases/tag/v0.1.7"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-gc24-px2r-5qmf","url":"https://osv.dev/vulnerability/GHSA-gc24-px2r-5qmf"}],"summary":"Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication"}