Threat database

Podgrab version 0 has a missing authentication vulnerability in its /ws WebSocket route, which is exposed on the root gin engine instead of being protected by BasicAuth. This allows unauthenticated clients to connect even when a password is configured. Attackers can hijack queue payloads intended for authenticated users, exposing episode metadata and server file paths, and potentially disrupting playback.

Podgrab version 0 contains a high-severity unauthenticated denial-of-service vulnerability due to a race condition in its WebSocket handler. Concurrent goroutines access shared maps without synchronization, leading to a Go runtime data race that crashes the process. An attacker can exploit this by opening multiple WebSocket connections and sending messages to trigger the crash, requiring manual service restoration.