Authentication Bypass in VikingBot OpenAPI of OpenViking by Volcengine

CVE-2026-40525

What is CVE-2026-40525?

OpenViking before commit c7bb167 exposes a significant security flaw within its VikingBot OpenAPI, where an authentication check can be bypassed. This issue arises when the api_key configuration is either unset or empty, allowing remote attackers with network access to leverage privileged functionalities without proper authorization. Consequently, they can submit arbitrary prompts, create or manipulate bot sessions, and gain unauthorized access to downstream tools, integrations, secrets, and data associated with the bot.

References