by Kastro
Paper/Archive/CVE-2026-49994

CVE-2026-49994

dannymcc bluehood — Bluehood: Missing authentication on Bluehood API routes when web auth is enabled

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
32
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 20.9.209 × 204.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when auth_enabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/* handlers (settings, devices, groups, per-device endpoints including /api/device/{mac}/notes) called no auth check at all. A network attacker reachable on the dashboard port could read Bluetooth tracking data and modify application state — including the heartbeat URL, prune retention, device groups, and per-device notes — without a session cookie. This issue has been patched in version 0.7.1.

Affected

ProductAffectedFixed inSource
bluehood< 0.7.1–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/dannymcc/bluehood/security/advisories/GHSA-qj2j-wcg3-74jwrefgithub.com/dannymcc/bluehood/commit/401479938c0deb1f6f6847d442f98a2d03efca68refgithub.com/dannymcc/bluehood/releases/tag/v0.7.1