CVE-2026-46488

motionEye (mEye), a web interface for the motion video-surveillance software, accepts client-controlled meye_username and meye_password_hash cookies as authentication credentials without validating them against a server-side session, so any attacker who knows a target username and its password hash can authenticate as that user by setting the cookies manually or by submitting blank credentials through the switch-user flow. The attack requires prior knowledge of the username and hash (reflected in the CVSS 'AT:P' requirement), but the administrator's username and password hash are stored in /etc/motioneye/motion.conf, which is globally readable by default, letting any local shell user harvest reusable administrator credential material. Successful impersonation allows an attacker to lock out the real account, change passwords for persistence, enumerate and destroy data, and exfiltrate camera configuration and recorded footage. All self-hosted motionEye installations running versions before 0.44.0 are affected, including hobbyist and small-business NVR setups that are frequently exposed to the internet. There is no known public proof of concept and no indication of in-the-wild exploitation, but the fix in version 0.44.0 should be treated as urgent given the critical severity rating.

What to do: Upgrade motionEye to version 0.44.0 or later immediately. Restrict access to the motionEye web UI (bind to localhost, front with a VPN or authenticated reverse proxy, or firewall the port) so unknown remote parties cannot reach the login at all. Harden /etc/motioneye/motion.conf permissions (e.g., chmod 600, owner root) to stop local users reading the admin password hash, rotate the administrator credential, and audit configs, user accounts, and stored footage for signs of prior tampering or exfiltration.