OpenBullet2 versions up to 0.3.2 on Windows expose the NTLMv2 hash of the process user. By configuring a job proxy source with a UNC path that points to an attacker‑controlled server, the application attempts to load proxies from that path. This triggers an SMB authentication, causing the victim machine to reveal its NTLMv2 hash. The hash can be relayed or cracked offline, allowing credential theft and potential compromise of other accounts authenticated with NTLMv2. The weakness is classed as CWE‑522, a credential disclosure flaw.

The vulnerability affects the OpenBullet2 application (openbullet:openbullet2) distributed for Windows, specifically versions up to and including 0.3.2.

The CVSS score of 7.1 indicates a high severity with significant impact on confidentiality. The EPSS score is not available, and the issue is not currently listed in CISA’s KEV catalog, suggesting no active exploitation campaigns yet. Attackers can exploit this flaw remotely by ensuring the victim’s OpenBullet2 process accesses a malicious UNC path; the victim machine does the SMB authentication, leaking the NTLMv2 hash. Once obtained, an attacker can use the hash to relay to other services or attempt offline cracking. The vulnerability requires only the ability to configure a job proxy source, making the attack surface relatively wide in untrusted environments.