CVE-2026-50025: Mousehole Auth Bypass Vulnerability

CVE-2026-50025 Overview

CVE-2026-50025 affects Mousehole, a background service that updates a seedbox IP for MyAnonamouse (MAM) and provides a web application to manage it. Versions prior to 0.4.05 expose the HTTP and WebSocket management boundary without application-layer authentication or LAN/browser provenance checks. Any client that can reach the service can read cookie-bearing state, subscribe to WebSocket updates, replace the stored MAM session cookie, or trigger MAM update side effects. The upstream deployment example publishes port 5010 broadly using Docker's 5010:5010 syntax, extending reachability across mixed-trust LAN and VPN interfaces. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Any network-adjacent client can read the stored MyAnonamouse session cookie and hijack the account, or overwrite the cookie to disrupt seedbox IP updates.

Affected Products

Mousehole versions prior to 0.4.0
Docker deployments using the documented 5010:5010 port publishing example
Any Mousehole instance reachable on a mixed-trust LAN or VPN interface

Discovery Timeline

2026-09-11 - CVE-2026-50025 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-50025

Vulnerability Analysis

Mousehole's management surface exposes both HTTP endpoints and a WebSocket channel for real-time state updates. Neither transport enforces authentication, session tokens, or origin checks. The service persists a MyAnonamouse session cookie in application state and reuses the same cookie-bearing serialization across three distinct consumers: on-disk state, public HTTP API responses, and WebSocket state broadcasts.

This shared serialization means the MAM session cookie leaks through any reachable channel. An attacker with network access to the published port can retrieve the cookie via a single HTTP request or by connecting to the WebSocket stream. The same interface accepts writes, letting the attacker replace the stored cookie or force MAM update side effects such as IP rotation.

Root Cause

The root cause is a missing authorization boundary between the management interface and untrusted network callers. The design conflates the internal state object, which legitimately carries the session cookie, with the external API and WebSocket contracts, which should redact or gate that field. The absence of provenance checks means the service cannot distinguish a local browser session from an arbitrary LAN client.

Attack Vector

Exploitation requires only network reachability to the Mousehole port, with no privileges and no user interaction. In the recommended Docker configuration, port 5010 binds to all interfaces, exposing the service to every host on the LAN or any connected VPN. An attacker issues an HTTP GET against the state endpoint or opens a WebSocket to receive the serialized state containing the MAM cookie. The cookie can then be replayed against MyAnonamouse to impersonate the account holder. Refer to the GitHub Security Advisory GHSA-v64r-gfrc-f6vq for the authoritative technical description.

Detection Methods for CVE-2026-50025

Indicators of Compromise

Unexpected inbound TCP connections to port 5010 from hosts other than the intended management workstation.
WebSocket upgrade requests to the Mousehole endpoint originating from unknown LAN or VPN clients.
Unexplained changes to the stored MAM session cookie or unexpected MAM IP update events in Mousehole logs.
MyAnonamouse account activity from IP addresses that do not correspond to the seedbox host.

Detection Strategies

Inventory all Mousehole deployments and confirm the version by inspecting the container image tag or the CHANGELOG.md shipped with the release.
Audit Docker port bindings and flag any container publishing 5010 without a loopback or explicit interface prefix.
Correlate MyAnonamouse login sources against the known seedbox egress IP to spot cookie replay.

Monitoring Recommendations

Log and alert on inbound connections to Mousehole ports from any subnet outside the administrative host.
Capture HTTP and WebSocket access logs from Mousehole and forward them to a central SIEM for review.
Track configuration drift on the Docker Compose or run-time port publishing directives used for Mousehole.

How to Mitigate CVE-2026-50025

Immediate Actions Required

Upgrade Mousehole to version 0.4.0 or later, which patches the exposure. The fix is documented in the Mousehole Change Log v0.40.
Rotate the MyAnonamouse session cookie immediately after upgrading, since the previous cookie may have been read by any LAN or VPN peer.
Rebind the Mousehole container to the loopback interface or a trusted management network until the upgrade is complete.

Patch Information

Mousehole 0.4.0 introduces authentication and provenance checks on the HTTP and WebSocket management interface, and stops serializing the MAM session cookie into external responses. Operators should pull the updated image, redeploy, and confirm the running version. Details are available in the GitHub Security Advisory GHSA-v64r-gfrc-f6vq.

Workarounds

Change the Docker port publishing from 5010:5010 to 127.0.0.1:5010:5010 to restrict access to the local host.
Place Mousehole behind a reverse proxy that enforces authentication and origin validation before forwarding requests.
Apply host firewall rules to permit access to port 5010 only from the specific administrative workstation.
Disconnect Mousehole from VPN interfaces that carry untrusted peers until the upgrade and cookie rotation are complete.

bash

# Configuration example: restrict Mousehole to loopback only
# docker-compose.yml
services:
  mousehole:
    image: ghcr.io/t-mart/mousehole:0.4.0
    ports:
      - "127.0.0.1:5010:5010"
    restart: unless-stopped