CVE-2026-25555
CWE-305Published: June 8, 2026· Updated: Jul 14, 2026
Official Description
OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middleware that allows unauthenticated attackers to gain admin access by supplying an empty X-Api-Key header value. Attackers can exploit the middleware's comparison of the supplied header against an empty AdminApiKey default string to access the admin console and all API endpoints without valid credentials.
Risk Analysis
This critical vulnerability in OpenBullet2 through version 0.3.2, rated 9.8 CVSS, is an authentication bypass flaw in the API key authentication middleware. Unauthenticated attackers can gain admin access by supplying an empty X-Api-Key header value. The high CVSS score indicates a severe impact on confidentiality, integrity, and availability.
No public exploit is currently known for this vulnerability. It is remotely exploitable with low attack complexity and requires no user interaction.
Users should upgrade OpenBullet2 to a version beyond 0.3.2. Ensure API key authentication mechanisms properly validate non-empty and valid API keys.
Technical Analysis
CVE-2026-25555 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (2)
Quick Facts
Related CVEs (CWE-305)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-25555 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts