CVE-2026-25555 describes an authentication bypass vulnerability in openbullet2 through version 0.3.2. The issue arises because the API key authentication middleware compares the supplied X-Api-Key header against a default empty AdminApiKey string. If an attacker supplies an empty header value, the middleware incorrectly grants admin access. This allows unauthenticated attackers to access the admin console and all API endpoints without valid credentials. The vulnerability is remotely exploitable without privileges or user interaction and has a critical CVSS 4.0 score of 9.3. No patch or official remediation level has been disclosed.

An attacker can gain full administrative access to openbullet2 instances vulnerable to this flaw by simply supplying an empty X-Api-Key header. This bypasses authentication controls, potentially allowing complete control over the application and its API endpoints. The vulnerability is critical due to the lack of authentication requirements and the high privileges granted upon exploitation. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the openbullet2 admin interface and API endpoints via network controls and monitor for suspicious requests with empty X-Api-Key headers. Avoid exposing the service to untrusted networks.