CVE-2026-25555 json
OpenBullet2 0.3.2 Authentication Bypass via X-Api-Key Header
published 2026-06-08 5 mo ago modified 2026-07-23 3 mo ago also EUVD-2026-35138
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.3%
- EPSS 2.3% chance of exploitation in 30 days, percentile 83%
- public exploits
- 2
- Metasploit, plus a Nuclei check
Summary
OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middleware that allows unauthenticated attackers to gain admin access by supplying an empty X-Api-Key header value. Attackers can exploit the middleware's comparison of the supplied header against an empty AdminApiKey default string to access the admin console and all API endpoints without valid credentials.
Timeline
- First public exploit (Metasploit auxiliary/scanner/http/openbullet2_unauth_hash_disclosure_cve_2026_39908)
- Published
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 5 mo ago
Exploit prediction
2.26% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit auxiliary/scanner/http/openbullet2_unauth_hash_disclosure_cve_2026_39908 OpenBullet2 NTLMv2 Hash Disclosure via UNC Path Proxy Source metasploit auxiliary, normal rank, 2026-06-08
- Metasploit exploit/multi/http/openbullet2_unauth_rce_cve_2026_25856 OpenBullet2 Unauthenticated RCE via Config Configuration Interface metasploit exploit, excellent rank, 2026-06-08
- Nuclei template OpenBullet2 <= 0.3.2 - Authentication Bypass nuclei detection template
- hackernoon.com https://hackernoon.com/one-empty-header-to-admin-how-an-auth-bypass-breaks-openbullet2 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- openbullet openbullet2
Classification
- Weakness
-
- CWE-305 Authentication Bypass by Primary Weakness
References
-
hackernoon.com
/one-empty-header-to-admin-how-an-auth-bypass-breaks-openbullet2
technical-description, exploit
-
vulncheck.com
/advisories/openbullet2-authentication-bypass-via-x-api-key-header
third-party-advisory
Sources
- CVE List CVE-2026-25555
- NVD CVE-2026-25555
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.