critical2026-02-02 CVE-2026-25505-Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication GHSA-gc24-px2r-5qmf