CVE-2026-25856 is an authenticated remote code execution vulnerability in OpenBullet2 through version 0.3.2. It allows authenticated users to execute arbitrary C# code on the server host by manipulating job configurations. The vulnerability stems from the plain C# execution mode lacking reference filtering or API restrictions, enabling attackers to perform actions such as file system access, process spawning, and invoking arbitrary .NET APIs with the privileges of the running process.

Successful exploitation allows an authenticated user to execute arbitrary code on the server hosting OpenBullet2, potentially leading to full system compromise, data access, and control over the server environment. This can result in unauthorized file access, process execution, and manipulation of the server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users only and monitor for suspicious activity related to job configuration changes. Avoid using the vulnerable plain C# execution mode if possible.