CVE-2026-46488 in MotionEye
Summary
by MITRE • 09/15/2026
motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, motionEye accepts the client-controlled meye_username and meye_password_hash cookies as authentication material without server-side session validation. An unauthenticated attacker who knows a target username and corresponding hash can set the cookies manually or cause them to be loaded by submitting blank credentials through the switch-user authentication flow, after which the server authenticates the attacker as that user. The administrator username and password-hash value are stored in /etc/motioneye/motion.conf, which is globally readable by default, allowing a local shell user to obtain reusable administrator credential material. Successful impersonation can enable account lockout, password changes and persistence, data enumeration, data destruction, and data exfiltration. This issue is fixed in version 0.44.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in motionEye versions prior to 0.44.0 represents a critical authentication bypass flaw rooted in the improper handling of client-supplied session tokens. motionEye serves as an online interface for the motion video surveillance software, providing features such as real-time monitoring and motion detection. The core technical deficiency lies in the application's reliance on specific cookies, namely meye_username and meye_password_hash, to establish user identity without performing adequate server-side validation against a persistent session store or database. This design choice effectively treats client-controlled data as authoritative proof of authentication, violating fundamental security principles regarding state management and trust boundaries. By accepting these values directly from the HTTP request context without verifying their integrity or existence in a secure backend registry, the system allows any actor possessing valid credential material to impersonate an existing user session trivially.
The exploitation vector for this vulnerability is multifaceted but primarily relies on two distinct attack paths depending on the attacker's initial access level. For remote attackers who have already obtained administrative credentials through other means or social engineering, the process involves manually setting the meye_username and meye_password_hash cookies in their browser session to assume control of that account. More critically for local threats, the vulnerability is exacerbated by a separate configuration file disclosure issue. The administrator username and password hash are stored within /etc/motioneye/motion.conf with default permissions that allow global read access. Consequently, any user with even minimal shell access on the host system can extract these credentials without authentication. Once obtained, an attacker can leverage the switch-user authentication flow by submitting blank or arbitrary credentials through this interface, which triggers the server to accept the previously extracted hash as valid for the targeted username, thereby granting full administrative privileges.
The operational impact of successful exploitation is severe and encompasses a wide range of malicious activities that compromise the integrity, availability, and confidentiality of the surveillance infrastructure. An attacker gaining unauthorized access can perform account lockouts to deny service to legitimate administrators or change passwords to establish persistent backdoor access. Beyond persistence, the ability to enumerate data allows for the viewing of recorded video footage, which may contain sensitive personal information depending on the deployment context. Furthermore, an authenticated adversary possesses the capability to destroy existing recordings through deletion commands and exfiltrate stored media files by downloading them via the web interface. This transforms a simple authentication flaw into a comprehensive compromise of the physical security monitoring system, potentially leading to significant privacy violations or operational disruption for organizations relying on motionEye for surveillance.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication and CWE-522 Insufficiently Protected Credentials, as it involves both bypassing authentication mechanisms and exposing sensitive credential material in an insecure manner. In terms of the MITRE ATT&CK framework, the exploitation technique corresponds to T1078 Valid Accounts, where attackers use legitimate credentials obtained through various means to access resources. The initial local file read that exposes the configuration hash falls under T1530 Data from Local System or potentially T1005 Data from Local System depending on whether exfiltration occurs immediately after extraction. To mitigate this risk, organizations must upgrade motionEye to version 0.44.0 or later where server-side session validation has been implemented. Additionally, administrators should review file system permissions for /etc/motioneye/motion.conf to ensure that credential files are not world-readable and enforce strong password policies alongside multi-factor authentication if supported by the platform architecture.