A missing authentication check in Bluehood API routes allows any network attacker on the dashboard port to read Bluetooth activity data and modify application state without a session cookie. The flaw exposes sensitive tracking information and permits alterations to heartbeat URL, prune retention, device groups, and per‑device notes, thereby compromising both confidentiality and integrity of the system configuration.

Product Bluehood from developer dannymcc is affected. All releases older than 0.7.1 contain the vulnerability; version 0.7.1 and later contain the fix.

The CVSS score of 9.1 labels it as critical, but the EPSS score is not available and it is not listed in the CISA KEV catalog. An attacker with network access to the local dashboard port can exploit the flaw by issuing simple HTTP requests to /api/* endpoints, bypassing authentication entirely. The vulnerability does not require elevated privileges, making it easily exploitable for both data leakage and unauthorized configuration changes.