Mousehole is a background service used to update a seedbox IP for the MyAnonamouse (MAM) service and its web app. Versions prior to 0.4.0 expose the HTTP/WebSocket management boundary without requiring authentication or verifying client origin, making it accessible to any client that can reach the published port (commonly 5010). The service stores a session cookie in state and reuses this cookie-bearing serialization across persisted state, public API responses, and WebSocket state updates. This design flaw allows any reachable client to read sensitive session cookies, connect to WebSocket updates, replace stored cookies, or trigger MAM update side effects. The vulnerability is patched in version 0.4.0.

An attacker with network access to the exposed Mousehole port can obtain sensitive session cookies, manipulate session state, and trigger unauthorized updates to the MAM service. This exposure of sensitive information and lack of authentication can lead to unauthorized access and control over the MAM session management, potentially compromising user privacy and service integrity.

Upgrade to mousehole version 0.4.0 or later, which patches this vulnerability by enforcing proper authentication and access controls on the HTTP/WebSocket management interface. Until upgraded, restrict network access to the published Mousehole port (commonly 5010) to trusted clients only to reduce exposure risk.