CVE-2026-25555: OpenBullet2 0.3.2 Authentication Bypass via X-Api-Key Header

Synopsis

Authentication bypass in OpenBullet2 version 0.3.2 and earlier allows any unauthenticated attacker to reach the admin console and all API endpoints over the network by supplying an empty X-Api-Key header value. No credentials, tokens, or account are required because the middleware incorrectly compares the supplied header against an empty default string, granting admin-level access on a match. Successful exploitation gives the attacker full read, write, and destructive control over the application. HarborGuard tracks this advisory for patch availability and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the OpenBullet2 API service over the network; the vulnerable endpoint is exposed via standard HTTP/HTTPS.

• AuthenticationNot required

  No credentials or API key are needed; supplying an empty X-Api-Key header value is sufficient to bypass authentication entirely.

• Victim interactionNot required

  Exploitation is fully automated and requires no action from any user or admin of the affected instance.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory layout knowledge, or environmental factors are required to trigger the bypass.

Blast Radius

• The attacker gains admin-level read access to all stored configuration, wordlists, proxies, and job results inside the OpenBullet2 instance.
• The attacker can create, modify, or delete any resource including configs, jobs, and user data through all authenticated API endpoints.
• The attacker can start, stop, or destroy running jobs, disrupting credential-stuffing or automation workflows managed by the instance.
• No lateral impact to systems outside the OpenBullet2 process is indicated by the CVSS vector, but admin API access can be used to exfiltrate sensitive inputs such as proxy lists and target credentials stored within the application.