CVE-2026-25555: OpenBullet2 Auth Bypass Vulnerability

CVE-2026-25555 Overview

CVE-2026-25555 is an authentication bypass vulnerability in OpenBullet2 through version 0.3.2. The flaw resides in the API key authentication middleware, which compares the X-Api-Key request header against an empty AdminApiKey default string. Unauthenticated attackers who supply an empty X-Api-Key header value gain admin access to the application. Successful exploitation grants full access to the admin console and every protected API endpoint without valid credentials. The vulnerability is tracked under CWE-305: Authentication Bypass by Primary Weakness.

Critical Impact
Remote, unauthenticated attackers gain administrative access to OpenBullet2 instances by sending a single HTTP request with an empty X-Api-Key header.

Affected Products

OpenBullet2 versions up to and including 0.3.2
Deployments using the default AdminApiKey configuration
Any exposed instance with the API key middleware enabled

Discovery Timeline

2026-06-08 - CVE-2026-25555 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-25555

Vulnerability Analysis

OpenBullet2 enforces API authentication through middleware that inspects the X-Api-Key header on incoming HTTP requests. The middleware performs a direct string comparison between the supplied header value and the configured AdminApiKey. When operators deploy OpenBullet2 without explicitly setting AdminApiKey, the value remains an empty string by default. An attacker who sends a request containing an X-Api-Key header with no value matches this empty default. The comparison returns true, and the middleware grants administrative privileges. This logic flaw maps to CWE-305, authentication bypass by primary weakness, because the authentication mechanism itself accepts an empty credential as valid.

Root Cause

The root cause is the combination of an insecure default value and a missing guard clause. The middleware does not reject requests when the configured AdminApiKey is empty or unset. It also does not reject empty header values. Either check alone would prevent the bypass. Without them, the equality comparison submittedKey == AdminApiKey evaluates to true whenever both sides are empty strings.

Attack Vector

Exploitation requires only network reachability to the OpenBullet2 web interface. The attacker issues an HTTP request to any protected admin or API endpoint and includes an X-Api-Key header with an empty string value. No prior authentication, user interaction, or special privileges are required. The middleware authorizes the request as an administrator, exposing job management, configuration data, wordlists, proxies, and arbitrary API operations. For technical proof-of-concept details, refer to the HackerNoon analysis and the VulnCheck advisory.

Detection Methods for CVE-2026-25555

Indicators of Compromise

HTTP requests to OpenBullet2 endpoints containing an X-Api-Key header with an empty value
Successful 200 OK responses from /api/v1/ administrative routes originating from unfamiliar source IP addresses
Unexpected creation, modification, or execution of jobs, configs, or wordlists in OpenBullet2 logs
Access to the admin console from IP addresses not associated with legitimate operators

Detection Strategies

Inspect web server and reverse proxy logs for requests where the X-Api-Key header is present but empty
Alert on any administrative API call when the configured AdminApiKey value is empty or missing
Correlate inbound requests to OpenBullet2 admin endpoints with authentication state and source reputation
Deploy web application firewall rules that block requests containing an empty X-Api-Key header value

Monitoring Recommendations

Forward OpenBullet2 application and access logs to a centralized SIEM for retention and query
Baseline normal administrative API usage and alert on volume or source anomalies
Monitor outbound network traffic from hosts running OpenBullet2 for signs of post-compromise activity

How to Mitigate CVE-2026-25555

Immediate Actions Required

Set a strong, randomly generated value for AdminApiKey in the OpenBullet2 configuration before exposing the service
Remove direct internet exposure of OpenBullet2 instances and place them behind a VPN or authenticated reverse proxy
Audit access logs for requests containing an empty X-Api-Key header and treat matches as potential compromise
Rotate any secrets, proxies, wordlists, or credentials stored within affected OpenBullet2 instances

Patch Information

No official vendor patch is referenced in the available advisories at the time of publication. Administrators should track the VulnCheck advisory and the OpenBullet2 project for an updated release that rejects empty AdminApiKey values and empty header inputs. Until a fixed version is available, apply the configuration workarounds below.

Workarounds

Configure AdminApiKey with a high-entropy value of at least 32 random characters
Reject requests with empty X-Api-Key headers at an upstream reverse proxy such as nginx or HAProxy
Restrict access to OpenBullet2 administrative endpoints by source IP allowlist
Disable the API key middleware entirely if the API surface is not required for operations

bash

# Example nginx rule to block empty X-Api-Key headers
if ($http_x_api_key = "") {
    return 403;
}