CVE-2026-104058: Podgrab Missing Authentication on WebSocket /ws Endpoint
Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin engine instead of the BasicAuth-protected router group, allowing unauthenticated network clients to connect even when PASSWORD is configured. Attackers can join the allConnections set, capture PlayerExists broadcasts containing client-supplied player identifiers, and replay them in a RegisterPlayer message to hijack queue payloads intended for authenticated users, exposing episode IDs, titles, and server-side file paths while potentially disrupting legitimate playback.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Register the /ws WebSocket route on the BasicAuth-protected router group instead of the root gin engine so unauthenticated network clients cannot connect when PASSWORD is configured.
Podgrab /ws WebSocket route router group = BasicAuth-protected router group
Event History
Frequently Asked Questions
Does configuring PASSWORD prevent unauthenticated access to the affected functionality?
No. The /ws route is registered outside the BasicAuth-protected router group, so unauthenticated network clients can connect even when PASSWORD is configured.
What does an attacker need to exploit this issue?
An attacker only needs network access to the Podgrab WebSocket endpoint. No authentication or user interaction is required.
What can an unauthenticated client obtain or disrupt after connecting?
They can receive PlayerExists broadcasts containing client-supplied player identifiers and replay an identifier in a RegisterPlayer message. This can hijack queue payloads for authenticated users, exposing episode IDs, titles, and server-side file paths, and may disrupt legitimate playback.