CVE-2026-49994: Bluehood: Missing authentication on Bluehood API routes when web auth is enabled
Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers (settings, devices, groups, per-device endpoints including /api/device/{mac}/notes) called no auth check at all. A network attacker reachable on the dashboard port could read Bluetooth tracking data and modify application state — including the heartbeat URL, prune retention, device groups, and per-device notes — without a session cookie. This issue has been patched in version 0.7.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Bluehoodto a version that resolves this vulnerability.Fixed in 0.7.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Bluehood deployments before version 0.7.1 are exposed when web authentication is enabled and an attacker can reach the dashboard port over the network. The affected API routes do not require a session cookie.
What could an unauthenticated attacker do?
An attacker could read Bluetooth tracking data and modify application state through /api/* endpoints. Documented changes include the heartbeat URL, prune retention, device groups, and notes for individual devices.
Does enabling web authentication protect the API?
No. Before version 0.7.1, web authentication was enforced only by HTML page handlers; the /api/* handlers performed no authentication check.
What is the remediation?
Upgrade Bluehood to version 0.7.1, which patches the missing authentication checks on the API routes.