CVE-2026-50025

Received Received - Intake

Authentication Bypass in Mousehole Service

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: GitHub, Inc.

Description

Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSocket management boundary is reachable without application-layer authentication or browser/LAN provenance checks. The service stores a MyAnonamouse (MAM) session cookie in state and reuses the same cookie-bearing serialization for persisted state, public API responses, and WebSocket state updates. Any client that can reach the published Mousehole port can read cookie-bearing state, connect to WebSocket state updates, replace the stored cookie, or force MAM update side effects. The deployment examples publish port 5010 broadly with Docker's `5010:5010` syntax, which can make the issue reachable on mixed-trust LAN/VPN interfaces. Version 0.4.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-50025

Affected Vendors & Products

Vendor	Product	Version / Range
mousehole	mousehole	to 0.4.05 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-346	The product does not properly verify that the source of data or communication is valid.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

Mousehole before version 0.4.05 has an authentication bypass flaw in its HTTP/WebSocket management interface. The service exposes this interface without requiring authentication or checking client origin. It reuses a MyAnonamouse session cookie across state persistence, API responses, and WebSocket updates, allowing unauthorized access to sensitive operations.

Detection Guidance

Check if Mousehole service is running on port 5010 by using commands like 'netstat -tulnp | grep 5010' or 'ss -tulnp | grep 5010'. Verify if the service is accessible without authentication by attempting to connect via 'curl http://localhost:5010' or 'nc -zv localhost 5010'.

Impact Analysis

An attacker who can reach the Mousehole port (default 5010) could read or replace the stored session cookie, intercept WebSocket updates, or trigger unintended MyAnonamouse updates. This could lead to unauthorized access to user accounts or data managed by Mousehole.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive session cookies and state data, potentially exposing user credentials or session tokens. This may violate GDPR's data protection requirements for confidentiality and integrity of personal data, and HIPAA's safeguards for protected health information if such data is involved.

Mitigation Strategies

Upgrade Mousehole to version 0.4.0 or later immediately. If upgrading is not possible, restrict access to port 5010 using firewall rules or network policies to prevent unauthorized access.

Hi! I’m here to help you understand CVE-2026-50025. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70