Threats affecting pkg:github/dannymcc/bluehood

CVE-2026-49994 is a critical vulnerability in dannymcc bluehood prior to version 0.7.1. When authentication is enabled, only HTML page handlers enforced session validation, while API endpoints under /api/* did not check authentication. This allowed a network attacker with access to the dashboard port to read Bluetooth tracking data and modify application state without a session cookie. The issue is fixed in version 0.7.1.