Vulnerability · Published Jun 8, 2026 · Assigned by VulnCheck

CVE-2026-25555OpenBullet2 0.3.2 Authentication Bypass via X-Api-Key Header

Critical 9.8

In plain English

A critical-severity security flaw in openbullet2 from openbullet. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)2.3%top 16.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling2Metasploit, Nuclei

Official description

OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middleware that allows unauthenticated attackers to gain admin access by supplying an empty X-Api-Key header value. Attackers can exploit the middleware's comparison of the supplied header against an empty AdminApiKey default string to access the admin console and all API endpoints without valid credentials.

Affected products (as reported)

Vendor	Product	Versions
openbullet	openbullet2	0 – through 0.3.2

Weakness: CWE-305 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://hackernoon.com/one-empty-header-to-admin-how-an-auth-bypass-breaks-openbullet2 technical-description, exploit
https://www.vulncheck.com/advisories/openbullet2-authentication-bypass-via-x-api-key-header third-party-advisory