Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-46488: motionEye lets attackers log in with password hash
CVE-2026-46488 · published 27 days ago
Summary
Versions of motionEye before 0.44.0 accept login information that can be set by anyone, so a person who knows a user’s password hash can pretend to be that user. The admin password hash is stored in a file that many users can read, making it easy for a local attacker to copy and reuse. Update to version 0.44.0 and restrict read access to the configuration file to stop this from happening.
What to do
- Update jean michault motioneye to version 0.44.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | motioneye-project | motioneye | < 0.44.0 |
| pip | jean michault | motioneye |
< 0.44.0 Fix: upgrade to 0.44.0
|
Original advisory text
motionEye: Authentication possible via password hash
motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, motionEye accepts the client-controlled meye_username and meye_password_hash cookies as authentication material without server-side session validation. An unauthenticated attacker who knows a target username and corresponding hash can set the cookies manually or cause them to be loaded by submitting blank credentials through the switch-user authentication flow, after which the server authenticates the attacker as that user. The administrator username and password-hash value are stored in /etc/motioneye/motion.conf, which is globally readable by default, allowing a local shell user to obtain reusable administrator credential material. Successful impersonation can enable account lockout, password changes and persistence, data enumeration, data destruction, and data exfiltration. This issue is fixed in version 0.44.0.
References
- https://github.com/advisories/GHSA-r3cw-c95m-wfh9
- https://github.com/motioneye-project/motioneye/commit/0d5cb9c238a87447dae29812e5...
- https://github.com/motioneye-project/motioneye/pull/3332
- https://github.com/motioneye-project/motioneye/releases/tag/0.44.0
- https://github.com/motioneye-project/motioneye/security/advisories/GHSA-r3cw-c95...
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46488... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-46488 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-256Plaintext Storage of a Password
CWE-287Improper Authentication
CWE-328Use of Weak Hash
CWE-836Use of Password Hash Instead of Password for Authentication
Timeline
Published15 Sep 2026
Updated11 Oct 2026
First seen22 Jun 2026
Track software like this
Free during beta