motionEye before version 0.44.0 accepts client-controlled authentication cookies without validating server-side sessions, allowing attackers who know a username and corresponding password hash to authenticate as that user. Administrator credentials are stored in /etc/motioneye/motion.conf with global read permissions, enabling local users to obtain these credentials. Exploitation can result in impersonation, account lockout, unauthorized password changes, and data compromise. The vulnerability is addressed by an official fix in version 0.44.0.

An unauthenticated attacker who knows a valid username and password hash can impersonate that user due to lack of server-side session validation. Local users can read administrator credentials from a globally readable configuration file, facilitating privilege escalation. Successful exploitation can lead to account lockout, unauthorized password changes, persistence, data enumeration, destruction, and exfiltration. The CVSS 4.0 score is 9.1 (critical), indicating high severity.

Upgrade motionEye to version 0.44.0 or later, where this vulnerability is fixed. Restrict permissions on /etc/motioneye/motion.conf to prevent unauthorized local access. No other mitigations are indicated by the vendor advisory.