motionEye (mEye) is an online interface for a piece of software called motion, a video surveillance program with motion detection. Prior to 0.44.0, motionEye accepts the client‑controlled meye_username and meye_password_hash cookies as authentication material without server‑side session validation. An unauthenticated attacker who knows a target username and corresponding hash can set the cookies manually or cause them to be loaded by submitting blank credentials through the switch‑user authentication flow, after which the server authenticates the attacker as that user. The administrator username and password‑hash value are stored in /etc/motioneye/motion.conf, which is globally readable by default, allowing a local shell user to obtain reusable administrator credential material. Successful impersonation can enable account lockout, password changes and persistence, data enumeration, data destruction, and data exfiltration. This issue is fixed in version 0.44.0.

The vulnerable product is motionEye from the motioneye‑project, with all releases older than version 0.44.0 affected. The administrator credentials are stored in the file /etc/motioneye/motion.conf, which is by default world‑readable, allowing any local shell user to obtain reusable hashed passwords. The issue is confined to the authentication mechanism that relies on the client‑supplied cookies; image streams or other functional components are not directly impacted.

The CVSS score of 9.1 indicates a severe authentication bypass with the potential for full account takeover. The EPSS score of < 1 % reflects a very low but non‑zero probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog, indicating limited evidence of active exploitation. The attack can be carried out locally, as any user can read the world‑readable /etc/motioneye/motion.conf to obtain password hashes, or remotely, by manipulating cookies via a web browser or automated script. Successful exploitation permits the attacker to impersonate any user, including administrators, granting the ability to lock accounts, change passwords, maintain persistence, enumerate or delete captured footage, and exfiltrate data. Until a patch is applied, the risk remains critical.