OpenChamber version 1.11.7 contains a critical authentication bypass vulnerability (CVE-2026-53977) due to the /api/system/shutdown endpoint being registered before the authentication middleware in the Express route handler chain. This allows unauthenticated remote attackers to invoke the shutdown handler directly by sending a POST request, terminating the server process. The flaw arises from the route registration order in bootstrap-runtime.js, enabling denial of service by shutting down all active AI coding sessions and preventing legitimate remote access.

An unauthenticated remote attacker can cause a denial of service by terminating the OpenChamber server process via the exposed shutdown endpoint. This disrupts all active AI coding sessions and locks out legitimate users, regardless of any UI_PASSWORD configuration. The vulnerability does not require privileges or user interaction and can be exploited remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the OpenChamber server to trusted users only and consider disabling or restricting access to the /api/system/shutdown endpoint if possible.