Critical OpenViking Auth Bypass: Unset API Key Grants Full Bot Control

The National Vulnerability Database has disclosed a critical authentication bypass, CVE-2026-40525, affecting OpenViking prior to commit c7bb167. This vulnerability resides in the VikingBot OpenAPI HTTP route surface. The core issue is a ‘fail-open’ authentication check: if the api_key configuration value is unset or empty, the system bypasses authentication entirely.

This means any remote attacker with network access to an exposed service can invoke privileged bot-control functionality without needing a valid X-API-Key header. The implications are severe: attackers can submit arbitrary prompts, create and use bot sessions, and access downstream tools, integrations, sensitive data, or secrets that the bot itself can reach. The National Vulnerability Database assigns this a CVSS score of 9.1 (CRITICAL).

For defenders, this is a glaring configuration oversight that turns into a full-blown compromise. It’s not about complex exploits; it’s about a fundamental failure in how authentication is handled when a key configuration is missing. The attacker’s calculus is simple: find an OpenViking instance, check for an unset API key, and you own the bot and its integrated services.