Podgrab CVE-2026-104058

The /ws WebSocket route is registered on the root gin engine rather than the BasicAuth-protected router group, so it remains reachable even when the PASSWORD environment variable is configured - the vulnerability is specifically meaningful on instances that otherwise rely on BasicAuth for protection. The attacker needs network reachability to the Podgrab WebSocket endpoint. The primary limiting factor (reflected in CVSS AT:P) is that successful data theft depends on a legitimate authenticated user generating PlayerExists broadcasts with a client-supplied player identifier that the attacker can capture and replay; absent concurrent legitimate playback activity there is no queue payload to hijack. Impact is confined to information disclosure (episode IDs, titles, server-side file paths) and potential disruption of legitimate playback - no code execution or integrity compromise.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 4.0 base of 6.3 (MEDIUM) reflects a realistic profile: network vector (AV:N) and no privileges (PR:N) make it remotely reachable by unauthenticated clients, but the AT:P (attack requirement present) and confidentiality-only impact (VC:L, with VI:N/VA:N) correctly cap the severity - this leaks data rather than granting code execution or takeover. Exploitation is publicly demonstrable: a proof-of-concept gist and a VulnCheck advisory are referenced, so publicly available exploit code exists. However, this is NOT confirmed active exploitation - there is no CISA KEV listing, so phrases like 'in the wild' do not apply. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here; this is a data gap. The AT:P metric is the key limiter - the attacker depends on legitimate authenticated player activity occurring (PlayerExists broadcasts with client-supplied identifiers) to have something worth replaying, which makes opportunistic mass exploitation less likely than the AV:N/PR:N combination alone would suggest. Net: a real, confirmed auth-bypass information-disclosure bug worth patching, but low real-world blast radius due to niche product footprint and confidentiality-only impact.

An attacker with network reachability to a Podgrab instance (even one protected by a configured PASSWORD) connects directly to the unauthenticated /ws WebSocket endpoint and joins the shared allConnections set. They passively capture PlayerExists broadcasts containing a legitimate user's client-supplied player identifier, then replay that identifier in a RegisterPlayer message to hijack queue payloads intended for the authenticated user, exposing episode IDs, titles, and server-side file paths. A public proof-of-concept gist demonstrating this flow exists.