CVE-2026-49994
Received Received - Intake

Unauthenticated API Access in Bluehood Bluetooth Monitor

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description
Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when auth_enabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/* handlers (settings, devices, groups, per-device endpoints including /api/device/{mac}/notes) called no auth check at all. A network attacker reachable on the dashboard port could read Bluetooth tracking data and modify application state — including the heartbeat URL, prune retention, device groups, and per-device notes — without a session cookie. This issue has been patched in version 0.7.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-49994
EUVD
EUVD-2026-88401

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
bluehood bluehood to 0.7.1 (exc)
dannymcc bluehood to 0.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Bluehood is a tool that monitors local Bluetooth activity. Prior to version 0.7.1, when authentication was enabled, the application failed to enforce session validation on API routes under /api/*. This allowed unauthenticated network attackers to access the dashboard port and interact with sensitive endpoints without a session cookie.

Detection Guidance

Check if Bluehood is running a vulnerable version (<=0.7.0) by inspecting the version in logs or the application interface. Verify if auth_enabled is set to true. Use network scanning tools like curl to test unauthenticated access to /api/* endpoints. Example: curl http://<bluehood-ip>:<port>/api/devices. If responses contain sensitive data without authentication, the system is vulnerable.

Impact Analysis

An attacker could read all Bluetooth tracking data and modify application state, including heartbeat URLs, retention policies, device groups, and per-device notes. This could lead to unauthorized changes in system behavior or data exposure.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive Bluetooth tracking data and application settings. GDPR requires protection of personal data, and HIPAA mandates secure handling of health-related information. Unauthorized modifications to device groups or notes could also violate data integrity requirements.

Mitigation Strategies

Upgrade Bluehood to version 0.7.1 or later immediately. If upgrading is not possible, restrict access to the dashboard port using a firewall or network controls. Deploy an authenticated reverse proxy in front of Bluehood to enforce session validation. Disable the auth_enabled setting if not required, but note this reduces security.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49994. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart