Akhilrex vulnerabilities
Published CVEs affecting Akhilrex products: 2 record(s), with severity, exploitation and fixes.
CVE-2026-104058
Medium · 5.3
CWE-306 Oct 1, 2026
Podgrab Missing Authentication on WebSocket /ws Endpoint
Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin engine instead of the BasicAuth-protected router group, allowing unauthenticated network clients to connect even when PASSWORD is configured. Attackers can join the allConnections set, capture PlayerExists broadcasts containing client-supplied player identifiers, and replay them in a RegisterPlayer message to hijack queue payloads intended for authenticated users, exposing episode IDs, titles, and server-side file paths while potentially disrupting legitimate playback.
CVE-2026-104057
High · 7.5
CWE-362 Oct 1, 2026
Podgrab Unauthenticated DoS via Concurrent Map Access in WebSocket Handler
Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps (activePlayers and allConnections) in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutines read and write these maps without a mutex. A remote attacker can open multiple WebSocket connections to the /ws endpoint and send messages in a loop to trigger a Go runtime data race that crashes the process, causing a denial of service that requires operator intervention to restore service.