Vulnerability in Openbullet Openbullet2
CVE-2026-25555
OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middleware that allows unauthenticated attackers to gain admin access by supplying an empty X-Api-Key header value. Attackers can exploit the middleware's comparison of the supplied header against an empty AdminApiKey default string to access the admin console and all API endpoints without valid credentials.
EPSS: 0.018 (77.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Openbullet Openbullet2 — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- disclosure@vulncheck.com (technical-description, exploit)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-25555?
- CVE-2026-25555 is a critical-severity vulnerability in Openbullet Openbullet2, classified under Authentication Bypass by Primary Weakness. CVSS score: 9.8/10. Published 2026-06-08.
- How severe is CVE-2026-25555?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2026-25555 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.