Description

OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the authentication middleware in the Express route handler chain. Attackers can exploit the route registration order in bootstrap-runtime.js to reach the shutdown handler before auth middleware executes, causing denial of service to all active AI coding sessions and locking out legitimate remote users regardless of whether UI_PASSWORD is configured.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-06T16:16:43.483Z",
  "pubdate": "2026-08-06T16:16:43.483Z",
  "executiveSummary": "OpenChamber version 1.11.7 suffers from a critical authentication bypass vulnerability residing within its Express route handling implementation. This security flaw enables unauthenticated remote attackers to completely terminate the server process via a targeted HTTP POST request directed at the sensitive endpoint.\nThe primary impact of this vulnerability is a complete Denial of Service (DoS) affecting the entire application infrastructure, resulting in the immediate termination of all active AI coding sessions and the total lockout of legitimate remote users.\nThis vulnerability affects OpenChamber version 1.11.7 and remains exploitable regardless of whether the UI_PASSWORD configuration mechanism is enabled or properly enforced. The attacker capabilities are limited to unauthenticated remote process termination, which requires network accessibility to the target service without requiring any prior authentication tokens, credentials, or privileged access levels.",
  "technicalDetails": "The root cause of the vulnerability stems from improper route registration ordering within the Express framework route handler chain, specifically implemented inside bootstrap-runtime.js. The application registers the administrative shutdown handler route prior to the initialization and execution of the core authentication middleware.\nBecause the route handler for the endpoint is evaluated earlier in the middleware pipeline than the security validation checks, any incoming request matching the specified path bypasses authentication evaluation entirely. Consequently, unauthenticated remote attackers interacting with the service over the network can successfully invoke the sensitive operation without supplying valid credentials.\nThe exploitation method relies on network exposure of the target instance. An attacker crafts an HTTP POST request targeting the /api/system/shutdown endpoint. Upon receiving the request, the Express router matches the URI against the prematurely registered route and immediately executes the underlying shutdown handler function without intercepting the request via the authentication middleware.\nThe payload behavior triggers the server process termination routines, immediately halting execution and dropping all active user connections and active AI coding sessions. The post-exploitation impact is persistent service unavailability (Denial of Service) requiring manual administrative intervention to restart the underlying server process."
}