OpenBullet2 0.3.2 Authentication Bypass via X-Api-Key Header
CVE-2026-25555

9.3CRITICAL

Key Information:

Vendor

Openbullet

Status
Openbullet2
Vendor
CVE Published:
8 June 2026

Badges

👾 Exploit Exists

What is CVE-2026-25555?

OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middleware that allows unauthenticated attackers to gain admin access by supplying an empty X-Api-Key header value. Attackers can exploit the middleware's comparison of the supplied header against an empty AdminApiKey default string to access the admin console and all API endpoints without valid credentials.

Affected Version(s)

openbullet2 0 <= 0.3.2

References

https://hackernoon.com/one-empty-header-to-admin-how-an-a...
technical-descriptionexploit
https://www.vulncheck.com/advisories/openbullet2-authenti...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Maksim Rogov
VulnCheck
.