CVE-2026-49994P2CRITICALCVSS 9.1fixed in 0.7.12026-09-28
CVE-2026-49994 [CRITICAL] CWE-306 CVE-2026-49994: Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when auth_enabled is set in Blue
Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when auth_enabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/* handlers (settings, devices, groups, per-device endpoints including /api/device/{mac}/notes) called no auth check at all. A network attacker reachable on the dashboard port co
nvd