CVE-2026-46488
Received Received - Intake

Authentication Bypass in motionEye via Session Cookie Manipulation

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, motionEye accepts the client-controlled meye_username and meye_password_hash cookies as authentication material without server-side session validation. An unauthenticated attacker who knows a target username and corresponding hash can set the cookies manually or cause them to be loaded by submitting blank credentials through the switch-user authentication flow, after which the server authenticates the attacker as that user. The administrator username and password-hash value are stored in /etc/motioneye/motion.conf, which is globally readable by default, allowing a local shell user to obtain reusable administrator credential material. Successful impersonation can enable account lockout, password changes and persistence, data enumeration, data destruction, and data exfiltration. This issue is fixed in version 0.44.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-46488
EUVD
EUVD-2026-78930

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
motioneye motioneye 0.44.0
motioneye motion *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-836 The product records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store.
CWE-328 The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).
CWE-256 The product stores a password in plaintext within resources such as memory or files.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in motionEye versions prior to 0.44.0. It allows unauthenticated attackers to impersonate any user by manipulating client-controlled cookies named meye_username and meye_password_hash. The server accepts these cookies as valid authentication material without proper server-side validation. Additionally, the admin account's credentials are stored in a globally readable file (/etc/motioneye/motion.conf), allowing local users to obtain these credentials and exploit the flaw.

Detection Guidance

Check if motionEye is running a version prior to 0.44.0 by inspecting the version in the web interface or via command line. Look for unauthorized cookie manipulation attempts in logs, particularly for meye_username and meye_password_hash cookies. Verify file permissions on /etc/motioneye/motion.conf to ensure it is not globally readable.

Impact Analysis

An attacker could impersonate any user, leading to account lockout, password changes, persistent access, data enumeration, destruction, or exfiltration. Local users could obtain admin credentials from the globally readable configuration file, enabling full system compromise. The vulnerability has a CVSS score of 9.1, indicating critical severity.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It enables data exfiltration, destruction, or enumeration, which are direct violations of data protection principles. The lack of proper authentication controls also fails to meet security best practices required by these regulations.

Mitigation Strategies

Upgrade motionEye to version 0.44.0 or later immediately. Ensure /etc/motioneye/motion.conf has restricted permissions (e.g., chmod 600). Review and revoke any unauthorized sessions or credentials. Monitor for suspicious activity such as repeated authentication attempts or unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46488. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart