Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-49994— Bluehood: Missing authentication on Bluehood API routes when web auth is enabled

Quick assessment

Affected
dannymcc bluehood
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Bluehood 会监控本地的蓝牙活动。在 0.7.1 版本之前，当启用 auth_enabled（启用认证）时，只有 HTML 页面处理器会执行会话验证。而所有 /api/* 路径的处理程序（包括设置、设备、组以及每个设备的专属端点如 /api/device/{mac}/notes 等）均未进行任何身份认证检查。处于同一网络、且能访问管理界面端口的攻击者，可以在不提供会话 Cookie 的情况下，读取蓝牙追踪数据并修改应用程序状态，包括心跳 URL、数据保留期限、设备分组以及每个设备的专属备注。该漏洞已在 0.7

CVSS 9.1 · Critical

Affected Version Matrix 1

VendorProduct Version RangeStatus
dannymcc bluehood < 0.7.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-49994

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Bluehood: Missing authentication on Bluehood API routes when web auth is enabled
Source: CVE Program / CVE List V5
Vulnerability Description
Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when auth_enabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/* handlers (settings, devices, groups, per-device endpoints including /api/device/{mac}/notes) called no auth check at all. A network attacker reachable on the dashboard port could read Bluetooth tracking data and modify application state — including the heartbeat URL, prune retention, device groups, and per-device notes — without a session cookie. This issue has been patched in version 0.7.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
dannymcc bluehood < 0.7.1 -

II. Public POCs for CVE-2026-49994

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-49994

请登录查看更多情报信息。

Other References for CVE-2026-49994 (3)

IV. Related Vulnerabilities

Same weakness: CWE-306

V. Comments for CVE-2026-49994

No comments yet

Leave a comment