DataBuff ai-apm-web Authentication Bypass Vulnerability

DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens.

The flaw is in JwtTokenService, which uses a hardcoded HMAC secret. Attackers can sign a payload with admin privileges and a future expiry using the default dev-secret to gain full administrative access to protected /webapi routes.

• Affected versions: 0.1.10 and earlier
• Impact: full admin access, including the Doris SQL query API