CVE-2026-104058

Name of the Vulnerable Software and Affected Versions Podgrab (affected versions not specified)

Description An authentication bypass exists because the '/ws' WebSocket endpoint is registered on the root gin engine rather than the BasicAuth-protected router group. This allows unauthenticated network clients to establish connections even when a PASSWORD is configured. An attacker can join the allConnections set and capture PlayerExists broadcasts containing client-supplied player identifiers. By replaying these identifiers in a RegisterPlayer message, an attacker can hijack queue payloads intended for authenticated users, leading to the exposure of episode IDs, titles, and server-side file paths, and potentially disrupting legitimate playback.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.