EUVD-2026-35138
GHSA-54jj-4v6g-j34h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed OpenBullet2 instance
-
DeliverySend request with empty X-Api-Key header
-
ExploitMiddleware matches empty AdminApiKey default
-
ExecutionGain admin session on API and console
-
ImpactExfiltrate configs and launch jobs
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Primary weakness mitigation
|
| Exploitation Conditions | Exploitation requires that the OpenBullet2 instance be running a version up to 0.3.2 with the AdminApiKey configuration value left at its empty default - which is the shipped default state - and the API/admin endpoints reachable over the network from the attacker. No authentication, no user interaction, no privileges, and no specific platform are required (CVSS AV:N/AC:L/AT:N/PR:N/UI:N). The only thing that LIMITS exploitation is operator-side hardening: setting a non-empty AdminApiKey, or placing the admin console behind network restrictions, blocks the bypass; instances exposed on the public internet with default config are directly exploitable. |
| Impact | Every available signal points to high real-world risk. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H scoring 9.3 means network-reachable, low-complexity, no privileges, no user interaction, and full confidentiality/integrity/availability impact on the vulnerable component. Publicly available exploit code (Hackernoon writeup) and a VulnCheck advisory mean weaponization is trivial - a single curl with an empty X-Api-Key header. EPSS and CISA KEV status were not provided in the input, so no public exploit identified in KEV at time of analysis, but absence of KEV listing should not lower priority given OpenBullet2's frequent exposure on internet-facing hosts and the credential-stuffing ecosystem that targets and uses it. Bottom line: a real, immediate priority for anyone running this software. |
| Exploit ScenarioDerived | An attacker discovers an internet-exposed OpenBullet2 instance via Shodan or similar and sends a single HTTP request to an admin API endpoint with the header 'X-Api-Key:' set to an empty value, which the middleware accepts as a valid admin credential. The attacker is dropped straight into the admin console and every API endpoint, where they can exfiltrate stored configs/wordlists/proxies, launch credential-stuffing jobs from the compromised host, or pivot further. Publicly available exploit instructions in the Hackernoon writeup make this a copy-paste attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Authentication bypass in OpenBullet2 through 0.3.2 lets unauthenticated remote attackers obtain full admin access by sending an empty X-Api-Key HTTP header, because the API key middleware compares the submitted value against a default empty AdminApiKey string. With CVSS 4.0 score 9.3, publicly available exploit code, and a writeup from VulnCheck/Hackernoon, this is a trivially exploitable flaw exposing the admin console and every API endpoint of any internet-reachable deployment running default configuration.
RemediationAI
No vendor-released patch identified at time of analysis - the input lists OpenBullet2 as affected through 0.3.2 with no fixed version disclosed. As immediate compensating controls, operators should explicitly configure a strong non-empty AdminApiKey value in OpenBullet2 configuration so the empty-vs-empty comparison can no longer succeed; restrict network exposure of the admin console and API endpoints to trusted IPs via firewall, reverse-proxy ACLs, or a VPN; and add an upstream WAF or reverse-proxy rule that blocks requests where the X-Api-Key header is present but empty (side effect: legitimate misconfigured clients sending empty headers will be rejected, which is desirable here). Monitor the VulnCheck advisory and the OpenBullet2 GitHub repository for a tagged release that fixes the middleware, and upgrade as soon as one is published. Reference: https://www.vulncheck.com/advisories/openbullet2-authentication-bypass-via-x-api-key-header.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenBullet2 is an open-source web automation and testing suite (cpe:2.3:a:openbullet:openbullet2) that exposes a management UI and REST API protected by an X-Api-Key header check performed in an ASP.NET-style authentication middleware. The root cause maps to CWE-305 (Authentication Bypass by Primary Weakness): the middleware authenticates by string-comparing the inbound header value to a configured AdminApiKey, but ships with an empty default value, so when the operator never sets a key, the comparison empty == empty succeeds and the request is treated as an authenticated admin. This is a classic insecure default combined with missing null/empty rejection logic on the credential path.
Know when Openbullet2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middleware that allows unauthenticated attackers to gain admin access by supplying an empty X-Api-Key header value. Attackers can exploit the middleware's comparison of the supplied header against an empty AdminApiKey default string to access the admin console and all API endpoints without valid credentials.
Executive ViewAI
OpenBullet2 versions 0.3.2 and earlier contain a critical authentication bypass vulnerability that enables unauthenticated attackers to obtain complete administrative access to any internet-facing instance. Publicly available exploit code exists for this trivially exploitable flaw, and no vendor patch is currently available. Organizations deploying this software on accessible networks face immediate and severe risk of administrative console compromise, full API access by unauthorized parties, and complete system takeover.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately isolate internet-facing OpenBullet2 instances; restrict network access to trusted internal networks and specific source IP addresses only via firewall rules; (2) Implement continuous monitoring and alerting on all API endpoints and admin console access for unauthorized activity or anomalous patterns; (3) Enable and monitor detailed access logs for forensic capability; (4) Consider operational suspension of OpenBullet2 until vendor releases patch or organization completes migration to alternative tooling.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Openbullet2
View allRemote code execution in OpenBullet2 through 0.3.2 allows authenticated users to execute arbitrary OS commands by abusin
Path traversal in OpenBullet2 through 0.3.2 lets authenticated attackers read, write, and delete arbitrary files via the
Authenticated remote code execution in OpenBullet2 through version 0.3.2 allows any logged-in user to run arbitrary C# c
Credential disclosure in OpenBullet2 through 0.3.2 on Windows allows authenticated remote attackers to coerce SMB authen
Exploit-DB