{"items":[{"id":"NVI-00018376","kind":"vulnerability","title":"motionEye: Authentication possible via password hash","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-r3cw-c95m-wfh9","CVE-2026-46488"],"plain_summary":"GitHub lists this reviewed advisory for motioneye. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1912c62c826a9c3ff813191481422e5b"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1912c62c826a9c3ff813191481422e5b","url":"https://github.com/advisories/GHSA-r3cw-c95m-wfh9","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-r3cw-c95m-wfh9","publisher":"GitHub Advisory Database","observed_at":"2026-11-06T07:18:46.322Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1912c62c826a9c3ff813191481422e5b"],"technology":"motioneye","known_exclusions":[],"conditions_summary":"### Summary\nAn authentication bypass vulnerability exists due to improper trust in client-controlled cookies. The application accepts user-supplied cookie values containing a username and password-hash-derived value as sufficient authentication material. These cookies can be set or modified prior to login, allowing an unauthenticated attacker to impersonate arbitrary users without knowledge of the plaintext password. This issue stems from the absence of server-side validation of authentication state and reliance on attacker-controlled cookie data\n\n### Details\nThe vulnerability arises because the application accepts the client-supplied cookies named `meye_password_hash` and `meye_username` as sufficient authentication material. The server does not validate these values against a server-side session or enforce proper authentication checks before establishing an authenticated state. As a result, an unauthenticated attacker can set or modify these cookies to impersonate another user if the target username and corresponding hash are known.\n\nThese cookies normally appear after using the \"switch user\" functionality; however, they can be added manually prior to authentication using standar","public_affected_ranges":["< 0.44.0"]}],"null_published_at":"2026-11-07T07:07:39.828Z","source_updated_at":"2026-06-22T20:59:31.000Z","source_disclosed_at":"2026-06-22T20:59:31.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-06T07:18:46.322Z"}],"next_cursor":null,"snapshot_revision":"42594"}