Executive brief
OpenChamber is an agentic development environment that hosts AI coding sessions. A vulnerability allows attackers without credentials to remotely shut down the server by exploiting improper route registration, causing immediate denial of service to all active users and development sessions regardless of password configuration.
Technical details
The vulnerability is an authentication bypass caused by improper route registration order in bootstrap-runtime.js. The /api/system/shutdown endpoint is registered before authentication middleware in the Express route handler chain, allowing unauthenticated POST requests to reach the shutdown handler. No authentication or user interaction is required; an attacker needs only network access to the server. Exploitation results in immediate denial of service by terminating the server process, disrupting all active AI coding sessions and legitimate remote access. A patch was implemented on 2026-06-12 that hardened remote API security boundaries by reordering route registration.
Affected products
- OpenChamber OpenChamber 1.11.7
Timeline
- 2026-08-06: disclosed: CVE-2026-53977 published
- 2026-06-12: patched: Security hardening commit f1b9506 merged to harden remote API security boundaries