// Hacker Noon · 6 June 2026

One Empty Header to Admin: How an Auth Bypass Breaks OpenBullet2

This article walks through 5 CVEs: an empty X-Api-Key header that bypasses authentication by default, arbitrary C# and script-file execution, a wordlist path traversal granting arbitrary file read/write/delete as root, and an NTLMv2 hash leak on Windows.

Hacker Noon

@hacker-noon · Maksim Rogov

hackernoon.com

Hacker Noon@hacker-noon