---
title: "GHSA-phv5-334h-mxcw: motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal"
url: https://erroneo.us/security/ghsa/GHSA-phv5-334h-mxcw/
description: "GHSA-phv5-334h-mxcw (critical, PyPI): motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal. Partial…"
type: advisory
section: "Security Digest"
date_published: 2026-06-23
date_modified: 2026-06-23
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-phv5-334h-mxcw"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-phv5-334h-mxcw: motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal

## Affected packages

- PyPI `motioneye` < 0.44.0 → fixed: 0.44.0

## Details

Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal Summary Myself and others have reported several RCE vulnerabilities to this project. However, due to the nature of the app, these are largely not of all that much value, as there is built-in functionality to run commands upon certain actions — i.e. RCE is by design. With that in mind, I endeavored to find some sort of auth bypass, and was slightly successful. When the admin password is set but the normal (surveillance) user password is left empty (the default), an unauthenticated attacker can exploit a path traversal vulnerability to read the motionEye configuration file from disk. This file contains the admin password as a SHA-1 hash, and that hash is accepted directly as a signing key for admin API requests — no cracking required. The result is full admin access from zero credentials. This is a realistic scenario: many installations set an admin password to protect the settings UI but leave the normal user password empty so household members can view camera feeds without logging in. Details The vulnerability chains two independent issues: 1. Unauthenticated normal-user access when @normalpassword is empty In motioneye/handlers/base.py, lines 149-151: When @normalpassword is empty (the default — see config.py line 2251: data.setdefault('@normalpassword', '')), any request without a username parameter is silently granted normal user access. This is by design for convenience, but it means all normal-level endpoints are fully unauthenticated. 2. Path traversal in MoviePlaybackHandler (and related handlers) The movie playback handler at motioneye/handlers/movieplayback.py serves recorded video files. It accepts a filename in the URL path: The filename is passed to mediafiles.getmediapath() (mediafiles.py lines 497-500): When path is an absolute path (e.g. /etc/motioneye/motion.conf), Python's os.path.join() discards targetdir entirely and returns the absolute path as-is. This would normally be caught by Tornado's StaticFileHandler path validation, but MoviePlaybackHandler explicitly overrides both safety checks (movieplayback.py lines 111-115): This allows reading any file on the filesystem that the motionEye process can access. The same path traversal exists in the movie download,…

## Sources

- [GitHub Advisory GHSA-phv5-334h-mxcw](https://github.com/advisories/GHSA-phv5-334h-mxcw)
- [github.com](https://github.com/motioneye-project/motioneye/security/advisories/GHSA-phv5-334h-mxcw)

---
Source page: https://erroneo.us/security/ghsa/GHSA-phv5-334h-mxcw/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt