CVE-2026-46488

Name of the Vulnerable Software and Affected Versions MotionEye (affected versions not specified)

Description An authentication bypass occurs because the application improperly trusts client-controlled cookies. The server accepts the cookies meye username and meye password hash as sufficient authentication material without validating them against a server-side session or enforcing proper authentication checks. An unauthenticated attacker can manually set or modify these cookies to impersonate any user if the target username and corresponding password hash are known. Furthermore, the admin account username and hash are stored in the /etc/motioneye/motion.conf file, which is globally readable by default on the local system, allowing local users with shell access to obtain these credentials and impersonate the administrator.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.