CVE-2026-25555: OpenBullet2 0.3.2 Authentication Bypass via X-Api-Key Header
OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middleware that allows unauthenticated attackers to gain admin access by supplying an empty X-Api-Key header value. Attackers can exploit the middleware's comparison of the supplied header against an empty AdminApiKey default string to access the admin console and all API endpoints without valid credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenBullet2to a version that resolves this vulnerability.Fixed in 0.3.2 - Compensating control
Mitigate the X-Api-Key authentication bypass by ensuring the API key authentication middleware does not treat an empty X-Api-Key header value as a valid match to the default AdminApiKey empty string; require a non-empty X-Api-Key header value for admin/API access until patched.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25555?
CVE-2026-25555 has a critical severity rating of 9.8.
How do I fix CVE-2026-25555?
To fix CVE-2026-25555, update OpenBullet2 to the latest version that addresses this vulnerability.
What is CVE-2026-25555 concerning?
CVE-2026-25555 involves an authentication bypass due to an empty X-Api-Key header in OpenBullet2 versions 0.3.2 and below.
What impact does CVE-2026-25555 have?
CVE-2026-25555 allows unauthenticated attackers to gain admin access to the OpenBullet2 application.
When was CVE-2026-25555 published?
CVE-2026-25555 was published on June 8, 2026.