CVE-2026-39908: Insufficiently Protected Credentials in openbullet openbullet2
OpenBullet2 through version 0.3.2 on Windows contains a credential disclosure vulnerability that allows remote attackers to capture the NTLMv2 hash of the process user by configuring a job proxy source with a UNC path pointing to an attacker-controlled server. When the job starts, the application attempts to load proxies from the UNC path, triggering an SMB authentication attempt that discloses the NTLMv2 hash, which can then be relayed or cracked offline.
AI Analysis
Technical Summary
CVE-2026-39908 describes a credential disclosure vulnerability in OpenBullet2 on Windows up to version 0.3.2. When a job proxy source is set to a UNC path controlled by an attacker, the application attempts to load proxies from that path, triggering an SMB authentication attempt. This results in the NTLMv2 hash of the process user being sent to the attacker, who can then use the hash for relay attacks or offline cracking. The vulnerability requires the attacker to control the UNC path and the victim to start the job, but no user interaction is needed beyond that. The CVSS 4.0 score is 7.1, indicating high severity.
Potential Impact
The vulnerability allows remote attackers to obtain the NTLMv2 hash of the user running the OpenBullet2 process. This hash disclosure can lead to credential compromise through relay attacks or offline cracking, potentially allowing unauthorized access to systems or services that accept NTLM authentication from the compromised user context.
Mitigation Recommendations
No official fix or patch is currently available for this vulnerability. Users should avoid configuring job proxy sources with UNC paths pointing to untrusted or attacker-controlled servers. Monitor vendor advisories for updates or patches addressing this issue.
CVE-2026-39908: Insufficiently Protected Credentials in openbullet openbullet2
Description
OpenBullet2 through version 0.3.2 on Windows contains a credential disclosure vulnerability that allows remote attackers to capture the NTLMv2 hash of the process user by configuring a job proxy source with a UNC path pointing to an attacker-controlled server. When the job starts, the application attempts to load proxies from the UNC path, triggering an SMB authentication attempt that discloses the NTLMv2 hash, which can then be relayed or cracked offline.
CVSS v4.0
Score 7.1high
Affected software
pkg:github/openbullet/openbullet2Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-39908 describes a credential disclosure vulnerability in OpenBullet2 on Windows up to version 0.3.2. When a job proxy source is set to a UNC path controlled by an attacker, the application attempts to load proxies from that path, triggering an SMB authentication attempt. This results in the NTLMv2 hash of the process user being sent to the attacker, who can then use the hash for relay attacks or offline cracking. The vulnerability requires the attacker to control the UNC path and the victim to start the job, but no user interaction is needed beyond that. The CVSS 4.0 score is 7.1, indicating high severity.
Potential Impact
The vulnerability allows remote attackers to obtain the NTLMv2 hash of the user running the OpenBullet2 process. This hash disclosure can lead to credential compromise through relay attacks or offline cracking, potentially allowing unauthorized access to systems or services that accept NTLM authentication from the compromised user context.
Mitigation Recommendations
No official fix or patch is currently available for this vulnerability. Users should avoid configuring job proxy sources with UNC paths pointing to untrusted or attacker-controlled servers. Monitor vendor advisories for updates or patches addressing this issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-04-07T20:57:06.209Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a26f68ee29bf47b50440d3c
Added to database: 06/08/2026, 17:06:22 UTC
Last enriched: 07/15/2026, 10:26:29 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 46
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.