OpenBullet2 versions up to 0.3.2 contain a flaw in the API key authentication middleware that allows an unauthenticated attacker to supply an empty X-Api-Key header. Because the code compares the header value against a default empty AdminApiKey string, the request is treated as authenticated and grants full administrative access by bypassing credential checks. This weakness is a CWE‑305 instance where empty input is improperly handled, enabling an attacker to compromise the entire application without prior compromise.

The affected application is OpenBullet2 built on the openbullet:openbullet2 code base. Versions 0.3.2 and any earlier releases are vulnerable and operators running these editions face the risk of full administrative takeover.

The flaw receives a CVSS critical impact. An EPSS score of 2% shows a low but measurableers need only send a request with an empty X-Api-Key header to the API, without any additional credentials or privileges. The vulnerability is not listed in CISA KEV, yet it provides total control of the system when successful.