CVSS
7.5
CVSS v3.1
EPSS
0.5%
Exploit Prediction Score
Published
August 6, 2026
Exploitability
EPSS probability 0.5%
OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the authentication middleware in the Express route handler chain. Attackers can exploit the route registration order in bootstrap-runtime.js to reach the shutdown handler before auth middleware executes, causing denial of service to all active AI coding sessions and locking out legitimate remote users regardless of whether UI_PASSWORD is configured.
No package data available.
Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).