Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• critical

  motionEye LFI to Unauthenticated RCE Chain (CVSS 9.8)

  Four chained bugs in motionEye let a network attacker read any file on the server, steal the admin password hash, upload a malicious script via a tar restore, and execute it without any credentials…

• critical

  motionEye Unauthenticated Admin Credential Theft via Path Traversal

  A path traversal bug in motionEye's media playback handler lets a zero-credential attacker read the server's config file, steal the admin password hash, and immediately replay it for full admin…

• highCVE-2026-48126

  CVE-2026-48126: Algernon Host Header Path Traversal to Arbitrary File Read and Lua RCE

  A missing validation on the HTTP Host header in Algernon's domain mode lets any unauthenticated attacker read files outside the web root and, in common configurations, execute shell commands on the…

• highCVE-2026-48507

  CVE-2026-48507: Snipe-IT Bulk User Edit Incorrect Authorization

  A low-privileged Snipe-IT user with only the 'users.edit' permission can bulk-disable the 'activated' and 'ldap_import' flags on every admin account, locking all administrators out of the instance…

• highCVE-2026-54329

  CVE-2026-54329: Snipe-IT Cross-Tenant Accessory Injection via Mass Assignment

  A low-privileged user in one company can silently create accessory records under a different company by passing a foreign company_id to the Accessories API, breaking multi-tenant inventory isolation.

• criticalCVE-2026-45051

  CVE-2026-45051: OpenAM WebAuthn Authenticator Java Deserialization RCE

  OpenAM's WebAuthn authentication module deserializes a Java object read directly from a user-controlled LDAP attribute with no class filtering, allowing an attacker who can write to that attribute…

• criticalCVE-2026-45052

  CVE-2026-45052: OpenAM Liberty Discovery SOAP Improper Authorization

  An unauthenticated attacker can send a raw SOAP request to OpenAM's Liberty Web Services endpoint and permanently write records into any user's LDAP identity profile, because the server performs…

• highCVE-2026-48708

  CVE-2026-48708: OliveTin Concurrent Template Parsing Race Condition

  OliveTin reuses a single shared Go template object across all goroutines with no locking, so two concurrent action executions can swap each other's shell command templates, running the wrong command…

• highCVE-2026-45794

  CVE-2026-45794: OpenAM Push Notification Unsafe Java Deserialization via SNS Callback

  A flaw in OpenAM's anonymous SNS push callback endpoint lets an attacker plant a crafted JSON blob in the server's token store, causing OpenAM to load attacker-named Java classes and deserialize…

• highCVE-2026-46498

  CVE-2026-46498: OpenAM Arbitrary OAuth2 Token Minting via CTS Namespace Confusion

  A logic flaw in OpenAM's token store lets a low-privileged attacker plant a crafted JSON blob and have it accepted as a valid OAuth2 bearer token, granting access to any resource with…

• highCVE-2026-46560

  CVE-2026-46560: OpenAM RADIUS Client Authentication Bypass via Response Spoofing

  OpenAM's RADIUS client never validates the server response, so any attacker who can race or spray a forged Access-Accept UDP packet to the client port gains a full session as any RADIUS user without…

• criticalCVE-2026-48714

  CVE-2026-48714: i18next-http-middleware Prototype Pollution via Dotted Missing-Key

  A bypass in i18next-http-middleware's missing-key guard lets attackers send a crafted translation key like '__proto__.polluted' over HTTP, which downstream backends split and walk directly into…