Executive brief
OpenBullet2, a popular automation suite for web testing, contains a flaw that allows unauthorized individuals to gain full administrative control. By sending a specifically crafted empty header in a web request, an attacker can bypass security checks and access the admin console and all private data. This could lead to a total compromise of the application, including the theft of sensitive configurations and service disruption.
Technical details
An authentication bypass vulnerability exists in the API key authentication middleware of OpenBullet2 versions up to and including 0.3.2. The root cause is a logic error where the middleware compares a user-supplied 'X-Api-Key' header against a default 'AdminApiKey' string that may be empty. By providing an empty value in the 'X-Api-Key' header, a remote, unauthenticated attacker can satisfy the authentication condition. Successful exploitation grants full access to the administrative console and all API endpoints, allowing for complete system takeover.
Affected products
- OpenBullet2 OpenBullet2 through 0.3.2
Timeline
- 2026-06-08: advisory: NVD and VulnCheck published the advisory