CVE-2026-53977: OpenChamber 1.11.7 Unauthenticated DoS via /api/system/shutdown
OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the authentication middleware in the Express route handler chain. Attackers can exploit the route registration order in bootstrap-runtime.js to reach the shutdown handler before auth middleware executes, causing denial of service to all active AI coding sessions and locking out legitimate remote users regardless of whether UIPASSWORD is configured.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53977?
The severity of CVE-2026-53977 is rated high with a score of 7.5.
What does CVE-2026-53977 allow attackers to do?
CVE-2026-53977 allows unauthenticated remote attackers to terminate the OpenChamber server process.
How can I fix CVE-2026-53977?
To fix CVE-2026-53977, update OpenChamber to a version that contains the appropriate security patches.
What is the impact of CVE-2026-53977 on server availability?
CVE-2026-53977 can lead to a denial of service, affecting the availability of the OpenChamber servers.
Which endpoint is vulnerable in CVE-2026-53977?
The vulnerable endpoint in CVE-2026-53977 is /api/system/shutdown.