CVE-2026-104058 in Podgrab
Summary
by MITRE • 10/01/2026
Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin engine instead of the BasicAuth-protected router group, allowing unauthenticated network clients to connect even when PASSWORD is configured. Attackers can join the allConnections set, capture PlayerExists broadcasts containing client-supplied player identifiers, and replay them in a RegisterPlayer message to hijack queue payloads intended for authenticated users, exposing episode IDs, titles, and server-side file paths while potentially disrupting legitimate playback.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified within Podgrab represents a critical architectural flaw in the application's WebSocket authentication logic, specifically affecting the /ws endpoint. This issue stems from an incorrect registration of the WebSocket route handler on the root Gin engine rather than on the router group that is protected by Basic Authentication middleware. Consequently, when administrators configure the PASSWORD environment variable to enforce access control for authenticated users, this security measure fails to apply to incoming WebSocket connections. The design oversight allows any network client with connectivity to the Podgrab server to establish a persistent connection without providing valid credentials, effectively bypassing the intended authentication gate and exposing internal application states to unauthorized parties.
From an operational perspective, this lack of authentication enables attackers to join the allConnections set, which serves as a central hub for managing active WebSocket sessions within the application. Once connected, the attacker can subscribe to PlayerExists broadcasts, which are messages emitted by the server whenever a new player instance is registered or becomes visible in the system. These broadcast payloads contain sensitive client-supplied identifiers that uniquely distinguish one user session from another. By monitoring these events, an adversary gains visibility into active sessions and obtains the specific player IDs associated with legitimate, authenticated users who are currently interacting with the application.
The severity of this vulnerability escalates significantly when combined with message replay capabilities. An attacker can capture a valid PlayerExists broadcast containing a target user's identifier and subsequently inject it into a RegisterPlayer message sent to the server. This action allows the adversary to hijack queue payloads that were originally intended for the authenticated victim. By impersonating the legitimate player through this ID injection, the attacker gains unauthorized access to sensitive data structures associated with that session. This includes exposure of episode IDs, media titles, and critical server-side file paths, which reveals the underlying storage architecture and content organization of the Podgrab instance.
The impact extends beyond mere information disclosure. The ability to hijack queue payloads allows an attacker to disrupt legitimate playback experiences for targeted users. By manipulating the state associated with a victim's player ID, the adversary can alter or corrupt the media queue, leading to service disruption and degradation of user experience. This constitutes a denial-of-service condition specific to authenticated sessions, driven by the exploitation of trust in client-supplied identifiers that are not sufficiently validated against session ownership at the server level.
This vulnerability aligns with CWE-306, which describes missing authentication for critical functionality, as well as CWE-287, involving improper authentication mechanisms where credentials or tokens are bypassed due to configuration errors. In terms of offensive security frameworks, this behavior maps to ATT&CK technique T1590.004, specifically Gathering Victim Network Information through active reconnaissance and enumeration of connected sessions. The exploitation path also reflects aspects of CWE-284, improper access control, where the system fails to enforce restrictions on actions performed by unauthenticated entities.
To mitigate this risk, immediate remediation is required to correct the routing configuration within the Podgrab application codebase. The WebSocket handler for the /ws endpoint must be registered under the router group that includes the BasicAuth middleware, ensuring that all incoming connections are subjected to credential verification before any session state or broadcast subscriptions are granted. Additionally, developers should implement strict validation of player identifiers during registration processes to prevent ID hijacking via replay attacks. This involves binding client-supplied IDs to specific authenticated sessions and rejecting registrations where an identifier is already associated with a different active user context. Regular security audits of routing tables and middleware chains can help identify similar misconfigurations in other endpoints, ensuring that authentication controls are consistently applied across all communication channels exposed by the application.