CVE-2026-50025: Mousehole: Unauthenticated HTTP/WebSocket boundary exposes and mutates MAM cookie state
Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSocket management boundary is reachable without application-layer authentication or browser/LAN provenance checks. The service stores a MyAnonamouse (MAM) session cookie in state and reuses the same cookie-bearing serialization for persisted state, public API responses, and WebSocket state updates. Any client that can reach the published Mousehole port can read cookie-bearing state, connect to WebSocket state updates, replace the stored cookie, or force MAM update side effects. The deployment examples publish port 5010 broadly with Docker's 5010:5010 syntax, which can make the issue reachable on mixed-trust LAN/VPN interfaces. Version 0.4.0 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mouseholeto a version that resolves this vulnerability.Fixed in 0.4.0 - Compensating control
Restrict network access to the Mousehole published port (example: port 5010 when deployed with Docker `5010:5010`) so that only trusted interfaces/clients can reach the Mousehole HTTP/WebSocket management boundary.
Event History
Frequently Asked Questions
Which deployments should be prioritized for exposure review?
Prioritize instances that publish port 5010, especially Docker deployments using 5010:5010. Broad publication can expose the service on mixed-trust LAN or VPN interfaces, where any reachable client is in scope.
What does an attacker need to exploit this issue?
The attacker only needs network reachability to the published Mousehole port. No application-layer authentication or browser/LAN provenance check is required.
What could a reachable client do?
A reachable client can read cookie-bearing state, receive WebSocket state updates, replace the stored MAM cookie, and trigger MAM update side effects. This could expose or alter the session state Mousehole uses for MAM.
Which release should be used to remediate the issue?
The supplied information is inconsistent: it describes versions before 0.4.05 as affected, but separately states that version 0.4.0 patches the issue. Verify the upstream advisory or release notes before relying on either version number for remediation.