Which versions of OpenChamber are affected by EUVD-2026-54078?

OpenChamber 1.11.7 contains an authentication bypass in its system shutdown endpoint, allowing any unauthenticated attacker to instantly terminate the server and interrupt all active AI coding…. A patch is available.

How to fix or mitigate EUVD-2026-54078?

Within 24 hours, assess whether OpenChamber 1.11.7 instances are exposed to untrusted networks and implement temporary network controls (firewall rules restricting POST requests to /api/system/shutdown endpoint or blocking access to /api/system/ routes) as interim protection. Within 7 days, obtain and apply the vendor-provided security patch for OpenChamber as specified in the official security advisory. Within 30 days, conduct a comprehensive security review of other API endpoints for similar authentication bypass issues and validate patch effectiveness across the production environment.

OpenChamber EUVD-2026-54078

Q: What is the CVSS score of EUVD-2026-54078?

EUVD-2026-54078 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-53977 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-08-06 VulnCheck

GHSA-hw79-7vhm-4hc6

Authentication Bypass Denial Of Service Openchamber Bohdan Triapitsyn

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable unauthenticated endpoint, no complexity or interaction needed; sole impact is complete availability loss with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 06, 2026 - 16:08 vuln.today

Analysis Generated

Aug 06, 2026 - 16:08 vuln.today

CVE Published

Aug 06, 2026 - 14:43 cve.org

HIGH 8.7

DescriptionCVE.org

OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the authentication middleware in the Express route handler chain. Attackers can exploit the route registration order in bootstrap-runtime.js to reach the shutdown handler before auth middleware executes, causing denial of service to all active AI coding sessions and locking out legitimate remote users regardless of whether UI_PASSWORD is configured.

AnalysisAI

Unauthenticated remote shutdown of OpenChamber 1.11.7 is possible by sending a single POST request to /api/system/shutdown, terminating the server process and instantly denying service to all active AI coding sessions. The flaw stems from the /api/system/shutdown route being registered before the authentication middleware in the Express handler chain within bootstrap-runtime.js, meaning authentication is never evaluated for that endpoint regardless of whether UI_PASSWORD is configured. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack requires no privileges or user interaction and is trivially reproducible against any network-exposed instance.

Technical ContextAI

OpenChamber (CPE: cpe:2.3:a:bohdan_triapitsyn:openchamber:*:*:*:*:*:*:*:*) is an AI coding session management application built on an Express.js backend, packaged for both Electron desktop and Docker deployment. The root cause is CWE-306 (Missing Authentication for Critical Function): the Express route handler chain in bootstrap-runtime.js registers the POST /api/system/shutdown endpoint ahead of the middleware that enforces UI authentication, so the authentication check is never reached for that route. In Express.js, middleware and routes are evaluated in declaration order; by placing the shutdown handler before the auth middleware, the framework processes the shutdown request and exits the process before authentication logic can fire. This is independent of whether UI_PASSWORD or OPENCHAMBER_UI_PASSWORD is set - the misconfigured route order makes the setting irrelevant for this endpoint.

RemediationAI

Apply the vendor-released patch at commit f1b9506132faf6c564a2694c7f33b94421a49b4a (https://github.com/openchamber/openchamber/commit/f1b9506132faf6c564a2694c7f33b94421a49b4a); a tagged release version has not been independently confirmed from the available data, so treat the upstream commit as the authoritative fix reference. For Docker deployments, the patch enforces OPENCHAMBER_UI_PASSWORD as a required environment variable - set it before starting containers, for example via 'OPENCHAMBER_UI_PASSWORD=$(openssl rand -base64 24) docker compose up -d'. For Electron desktop with LAN access enabled, the patched version will refuse to bind to the LAN interface if no desktop UI password is configured, falling back to loopback-only. As an immediate compensating control prior to patching, restrict network access to the OpenChamber port using a firewall or network ACL to trusted IP ranges only; this prevents unauthenticated external actors from reaching the shutdown endpoint but does not fix the underlying auth bypass for already-trusted network segments. Do not rely on UI_PASSWORD alone as a mitigation - the route registration order flaw bypasses it entirely for the shutdown endpoint.