An authentication bypass flaw in the OpenChamber 1.11.7 server allows an unauthenticated attacker to trigger the /api/system/shutdown endpoint. The route is registered before the authentication middleware in the Express handler chain, so a plain POST request terminates the server process without any credential checks. This action stops all active AI coding sessions and blocks legitimate users from accessing the service, effectively denying availability.

The vulnerability affects OpenChamber content authored by Bohdan Triapitsyn, specifically version 1.11.7. No other product or vendor information is provided, and version details beyond 1.11.7 are not stated.

The CVSS score of 8.7 classifies this as a high‑severity problem. Because no authentication is required, the attack can be executed by any external host that can reach the target HTTP interface, making the exploitation path straightforward. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the path and impact are clear. CWE‑306 (Authentication Bypass) underscores the critical nature of the flaw.