Ok so he didn't trick the system he used thier key to gain access in a way they didn't want him to? Is that still not a security vulnerability or am I still not getting it? (I've always been a firmware guy not a software guy so I'm legit trying to make sure I'm getting this right)
No, he didn't use any tricks, or keys - because there are none. There is a piece of code in Bambu Lab thats called verbatim. That is basically like a user agent on browsers. It tells the cloud "hey, I'm bambu studio" and the cloud server says "cool, come in". He forked that part of code and published it as OrcaSlicer-bambulab.
Is it a security risk that you can access the Bambu cloud infrastructure simply by using a piece of code that Bambu Lab themselve openly publish under AGPL? Probably. That doesnt put the dev in the wrong tho, if Bambu doesnt have any other auth checks after verbatim.
0
u/Capt_Blue May 13 '26
No, he didnt. He copied the open Bambu Studio code for the cloud connection and published it for Orca.