motionEye: Authentication possible via password hash
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-256 and CWE-287.
Summary
motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, motionEye accepts the client-controlled meye_username and meye_password_hash cookies as authentication material without server-side session validation. An unauthenticated attacker who knows a target username and corresponding hash can set the cookies manually or cause them to be loaded by submitting blank credentials through the switch-user authentication flow, after which the server authenticates the attacker as that user. The administrator username and password-hash value are stored in /etc/motioneye/motion.conf, which is globally readable by default, allowing a local shell user to obtain reusable administrator credential material. Successful impersonation can enable account lockout, password changes and persistence, data enumeration, data destruction, and data exfiltration. This issue is fixed in version 0.44.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| motioneye-project | motioneye | before 0.44.0 | 0.44.0 | Patch available | CNA |
| — | motioneye (PyPI) | before 0.44.0 | 0.44.0 | Patch available | GHSA-r3cw-c95m-wfh9 |
- motioneye Vendormotioneye-project Affected before 0.44.0 Fixed in 0.44.0 Patch available CNA
- motioneye (PyPI) Vendor— Affected before 0.44.0 Fixed in 0.44.0 Patch available GHSA-r3cw-c95m-wfh9
Remediation
- Fix · CNA motioneye (motioneye-project) Fixed in 0.44.0
- Fix · GHSA-r3cw-c95m-wfh9 motioneye (PyPI) Fixed in 0.44.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-46488
- 2026-10-03 Alias added: GHSA-r3cw-c95m-wfh9
References
Other 5
- https://github.com/motioneye-project/motioneye/security/advisories/GHSA-r3cw-c95m-wfh9
- https://github.com/motioneye-project/motioneye/pull/3332
- https://github.com/motioneye-project/motioneye/commit/0d5cb9c238a87447dae29812e5bf2ccf323cf3dc
- https://github.com/motioneye-project/motioneye/releases/tag/0.44.0
- https://github.com/motioneye-project/motioneye
More motioneye-project vulnerabilities
- TI-2025-30247 motionEye vulnerable to RCE in add_camera Function Due to unsafe command execution CVSS 4.0HIGH 8.9
- TI-2026-40043 motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read CVSS 4.0HIGH 7.7
- TI-2025-37818 MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration… CVSS 3.1HIGH 7.2
- TI-2026-40322 motionEye: Missing authentication on ActionHandler allows unauthenticated camera action execution CVSS 3.1MEDIUM 5.3
- TI-2026-24521 motionEye: Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint CVSS 3.1MEDIUM 6.5
- TI-2026-24843 motionEye: World-Readable Configuration File Exposes Admin Password Hash CVSS 3.1MEDIUM 5.5
Sources
- CVE-2026-46488 · CVE Program
- CVE-2026-46488 · NVD
- FIRST EPSS
- GHSA-r3cw-c95m-wfh9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences