Podgrab
Monthly
Unauthenticated denial-of-service in Podgrab's WebSocket handler allows remote attackers to crash the process by exploiting a race condition in the activePlayers and allConnections maps, requiring manual operator restart to restore service. Affecting all versions per the CPE wildcard, the flaw is exploitable by anyone who can reach the /ws endpoint, with no authentication or user interaction needed. No public exploit code has been identified, but the low-complexity network vector and availability-only impact make it a plausible risk for internet-exposed instances, though Podgrab's limited footprint tempers its overall priority.
Unauthenticated WebSocket access in Podgrab can expose playback metadata and server-side file paths when the /ws route bypasses configured BasicAuth, allowing remote attackers to join the allConnections set and replay captured PlayerExists broadcasts as RegisterPlayer messages. This is a moderate-priority issue: the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N because meaningful data theft depends on a legitimate authenticated user generating broadcasts concurrently, and impact is limited to information disclosure plus possible playback disruption; no public exploit identified at time of analysis.
Unauthenticated denial-of-service in Podgrab's WebSocket handler allows remote attackers to crash the process by exploiting a race condition in the activePlayers and allConnections maps, requiring manual operator restart to restore service. Affecting all versions per the CPE wildcard, the flaw is exploitable by anyone who can reach the /ws endpoint, with no authentication or user interaction needed. No public exploit code has been identified, but the low-complexity network vector and availability-only impact make it a plausible risk for internet-exposed instances, though Podgrab's limited footprint tempers its overall priority.
Unauthenticated WebSocket access in Podgrab can expose playback metadata and server-side file paths when the /ws route bypasses configured BasicAuth, allowing remote attackers to join the allConnections set and replay captured PlayerExists broadcasts as RegisterPlayer messages. This is a moderate-priority issue: the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N because meaningful data theft depends on a legitimate authenticated user generating broadcasts concurrently, and impact is limited to information disclosure plus possible playback disruption; no public exploit identified at time of analysis.