CVE-2026-104058: Missing Authentication for Critical Function in akhilrex podgrab
Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin engine instead of the BasicAuth-protected router group, allowing unauthenticated network clients to connect even when PASSWORD is configured. Attackers can join the allConnections set, capture PlayerExists broadcasts containing client-supplied player identifiers, and replay them in a RegisterPlayer message to hijack queue payloads intended for authenticated users, exposing episode IDs, titles, and server-side file paths while potentially disrupting legitimate playback.
AI Analysis
Technical Summary
CVE-2026-104058 describes a missing authentication vulnerability in Podgrab's /ws WebSocket route. The route is registered on the root gin engine instead of the BasicAuth-protected router group, enabling unauthenticated network clients to connect despite password configuration. Exploitation allows attackers to join the allConnections set, capture PlayerExists broadcasts with client-supplied player identifiers, and replay these in RegisterPlayer messages. This leads to hijacking of queue payloads intended for authenticated users, exposing episode IDs, titles, and server-side file paths, and potentially disrupting legitimate playback sessions.
Potential Impact
Unauthenticated attackers can connect to the WebSocket endpoint and hijack playback queues, exposing sensitive episode information and server file paths. This can lead to information disclosure and disruption of legitimate playback for authenticated users.
Mitigation Recommendations
No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the /ws endpoint or deploy additional authentication controls to prevent unauthorized WebSocket connections.
CVE-2026-104058: Missing Authentication for Critical Function in akhilrex podgrab
Description
Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin engine instead of the BasicAuth-protected router group, allowing unauthenticated network clients to connect even when PASSWORD is configured. Attackers can join the allConnections set, capture PlayerExists broadcasts containing client-supplied player identifiers, and replay them in a RegisterPlayer message to hijack queue payloads intended for authenticated users, exposing episode IDs, titles, and server-side file paths while potentially disrupting legitimate playback.
CVSS v4.0
Score 6.3medium
Affected software
akhilrex
podgrab
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-104058 describes a missing authentication vulnerability in Podgrab's /ws WebSocket route. The route is registered on the root gin engine instead of the BasicAuth-protected router group, enabling unauthenticated network clients to connect despite password configuration. Exploitation allows attackers to join the allConnections set, capture PlayerExists broadcasts with client-supplied player identifiers, and replay these in RegisterPlayer messages. This leads to hijacking of queue payloads intended for authenticated users, exposing episode IDs, titles, and server-side file paths, and potentially disrupting legitimate playback sessions.
Potential Impact
Unauthenticated attackers can connect to the WebSocket endpoint and hijack playback queues, exposing sensitive episode information and server file paths. This can lead to information disclosure and disruption of legitimate playback for authenticated users.
Mitigation Recommendations
No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the /ws endpoint or deploy additional authentication controls to prevent unauthorized WebSocket connections.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-01T18:02:50.081Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6abea716a43b0b3b89e139cf
Added to database: 10/01/2026, 18:31:50 UTC
Last enriched: 10/01/2026, 18:46:53 UTC
Last updated: 10/02/2026, 03:48:57 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.