Which versions of OpenBullet2 are affected by EUVD-2026-35138?

OpenBullet2 versions 0.3.2 and earlier contain a critical authentication bypass vulnerability that enables unauthenticated attackers to obtain complete administrative access to any internet-facing…

Is there a public PoC exploit available for EUVD-2026-35138?

Yes, a public proof-of-concept exploit is available for EUVD-2026-35138. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-35138?

24 hours: Identify all OpenBullet2 instances running version 0.3.2 or earlier; immediately remove internet-facing access and isolate from external networks; begin comprehensive monitoring of admin console and API access logs for suspicious activity. 7 days: Conduct forensic analysis of access logs to determine if vulnerability has been exploited; contact vendor for patch availability and interim mitigation guidance; assess alternative tools and migration feasibility. 30 days: Implement permanent remediation-either deploy patched version upon vendor release or complete migration to alternative tool; if OpenBullet2 remains in use, restrict deployment to trusted internal networks only with strict firewall rules limiting access by source IP.

OpenBullet2 EUVD-2026-35138

Q: What is the CVSS score of EUVD-2026-35138?

EUVD-2026-35138 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-25555 CRITICAL

Authentication Bypass by Primary Weakness (CWE-305)

2026-06-08 VulnCheck

GHSA-54jj-4v6g-j34h

Authentication Bypass Openbullet2

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 17:22 vuln.today

CVSS changed

Jun 08, 2026 - 17:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

DescriptionCVE.org

OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middleware that allows unauthenticated attackers to gain admin access by supplying an empty X-Api-Key header value. Attackers can exploit the middleware's comparison of the supplied header against an empty AdminApiKey default string to access the admin console and all API endpoints without valid credentials.

AnalysisAI

Authentication bypass in OpenBullet2 through 0.3.2 lets unauthenticated remote attackers obtain full admin access by sending an empty X-Api-Key HTTP header, because the API key middleware compares the submitted value against a default empty AdminApiKey string. With CVSS 4.0 score 9.3, publicly available exploit code, and a writeup from VulnCheck/Hackernoon, this is a trivially exploitable flaw exposing the admin console and every API endpoint of any internet-reachable deployment running default configuration.

Technical ContextAI

OpenBullet2 is an open-source web automation and testing suite (cpe:2.3:a:openbullet:openbullet2) that exposes a management UI and REST API protected by an X-Api-Key header check performed in an ASP.NET-style authentication middleware. The root cause maps to CWE-305 (Authentication Bypass by Primary Weakness): the middleware authenticates by string-comparing the inbound header value to a configured AdminApiKey, but ships with an empty default value, so when the operator never sets a key, the comparison empty == empty succeeds and the request is treated as an authenticated admin. This is a classic insecure default combined with missing null/empty rejection logic on the credential path.

RemediationAI

No vendor-released patch identified at time of analysis - the input lists OpenBullet2 as affected through 0.3.2 with no fixed version disclosed. As immediate compensating controls, operators should explicitly configure a strong non-empty AdminApiKey value in OpenBullet2 configuration so the empty-vs-empty comparison can no longer succeed; restrict network exposure of the admin console and API endpoints to trusted IPs via firewall, reverse-proxy ACLs, or a VPN; and add an upstream WAF or reverse-proxy rule that blocks requests where the X-Api-Key header is present but empty (side effect: legitimate misconfigured clients sending empty headers will be rejected, which is desirable here). Monitor the VulnCheck advisory and the OpenBullet2 GitHub repository for a tagged release that fixes the middleware, and upgrade as soon as one is published. Reference: https://www.vulncheck.com/advisories/openbullet2-authentication-bypass-via-x-api-key-header.