CVE-2026-53977

Name of the Vulnerable Software and Affected Versions OpenChamber version 1.11.7

Description An authentication bypass allows unauthenticated remote attackers to terminate the server process, resulting in a denial of service for all active AI coding sessions and locking out legitimate users. This occurs because the '/api/system/shutdown' endpoint is registered in bootstrap-runtime.js before the authentication middleware in the Express route handler chain, allowing the shutdown handler to be reached regardless of whether UI PASSWORD is configured.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the '/api/system/shutdown' endpoint to minimize the risk of exploitation.