# motionEye auth bypass and path traversal in MoviePlaybackHandler

Source: https://junglewise.ai/threats/motioneye-auth-bypass-and-path-traversal-in-movieplaybackhandler-07e33cf4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

Severity: critical · CVSS 9.8 · Published 2026-06-23

motionEye is a popular web interface for managing surveillance cameras. A security flaw allows unauthenticated attackers to steal administrative credentials and take full control of the system if the secondary 'normal' user password is left at its default empty setting. This can lead to unauthorized viewing of camera feeds, theft of sensitive files from the device, and the ability to execute malicious commands on the underlying operating system.

Technologies: [motioneye (PyPI)](https://junglewise.ai/threats/technologies/motioneye). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Critical severity, with a CVSS score of 9.8, published 23 June 2026.

**Which products and versions are affected?** motioneye (PyPI) < 0.44.0.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a network appliance.

**Am I affected?** Check whether you run motioneye (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a chain of three issues in motionEye versions prior to 0.44.0. First, the application grants 'normal' user privileges to unauthenticated requests if the `@normal_password` is empty (the default). Second, multiple handlers including `MoviePlaybackHandler` and `MovieDownloadHandler` are vulnerable to path traversal because they override Tornado's `get_absolute_path` and `validate_absolute_path` safety checks, allowing an attacker to read arbitrary files like `motion.conf`. Third, the configuration file stores the admin password as a SHA-1 hash which the authentication logic in `base.py` accepts directly as a valid signing key for API requests. An attacker can exploit this to gain full administrative access and subsequently achieve Remote Code Execution (RCE) by configuring malicious shell commands in motion event hooks.

## Affected products

- motioneye-project motionEye < 0.44.0

## Timeline

- 2026-06-20: advisory: GitHub advisory published
- 2026-06-23: disclosed

## References

- [https://api.github.com/users/pizza-power](https://api.github.com/users/pizza-power)
- [https://github.com/pizza-power](https://github.com/pizza-power)
- [https://api.github.com/users/pizza-power/gists%7B/gist_id%7D](https://api.github.com/users/pizza-power/gists%7B/gist_id%7D)
- [https://api.github.com/users/pizza-power/repos](https://api.github.com/users/pizza-power/repos)
- [https://avatars.githubusercontent.com/u/6135659?v=4](https://avatars.githubusercontent.com/u/6135659?v=4)
- [https://api.github.com/users/pizza-power/events%7B/privacy%7D](https://api.github.com/users/pizza-power/events%7B/privacy%7D)

## Related threats

- [motionEye missing authentication in ActionHandler](https://junglewise.ai/threats/cve-2026-55863-motioneye-missing-authentication-in-actionhandler)
- [motionEye authentication bypass via password hash in cookies](https://junglewise.ai/threats/cve-2026-46488-motioneye-authentication-bypass-via-password-hash-in-cookies)
- [PYSEC-2026-681 - Unrestricted Upload of File with Dangerous Type in motionEye](https://junglewise.ai/threats/cve-2021-44255-unrestricted-upload-of-file-with-dangerous-type-in-motioneye)
- [motionEye insecure file permissions in motion.conf](https://junglewise.ai/threats/cve-2026-32315-motioneye-insecure-file-permissions-in-motion-conf)
- [motionEye path traversal in picture and movie API endpoints](https://junglewise.ai/threats/cve-2026-31978-motioneye-path-traversal-in-picture-and-movie-api-endpoints)