CVE-2026-49994 Details

A missing authentication vulnerability has been identified in Bluehood, a Bluetooth activity monitoring application, in versions prior to 0.7.1. When the 'auth_enabled' feature is activated, the application fails to enforce session validation on its API routes, allowing network attackers to access Bluetooth tracking data and alter application settings without a session cookie. This vulnerability is particularly concerning as it enables unauthorized modifications to device groups, per-device notes, and other application states. The issue has been patched in version 0.7.1.

Users should upgrade to Bluehood version 0.7.1, which addresses this vulnerability by implementing a default-deny authentication middleware that requires a valid session for all routes except a specified allowlist of authentication endpoints. For those unable to upgrade immediately, it is recommended to use a reverse proxy that requires authentication or to restrict access to the dashboard port.