← Back to Security Research Portal (ccsimplyspolit.github.io)

GHSA-pvw7-7j8c-qx96: Authorization Bypass via Pre-Decode Query-Parameter Truncation & Raw Query-String Forwarding in api_handlers_go2rtc_proxy.c (opensensor/lightNVR)

[OFFICIALLY PUBLISHED BY VENDOR • CVE REQUESTED FROM GITHUB CNA • PATCHED IN v0.44.3]
Officially published by upstream maintainer @matteius on 2026-10-29T04:38:44Z as GHSA-pvw7-7j8c-qx96 (state: published, High severity, CVE requested from GitHub CNA on 2026-10-29) with official reporter credit to @ccsimplyspolit, and patched upstream in v0.44.3 (commit 507bce1c0715: Restore authenticated go2rtc live view and harden media proxy).

0x00 // GitHub Security Advisory & Remediation Metadata

{
  "ghsa_id": "GHSA-pvw7-7j8c-qx96",
  "repository": "opensensor/lightNVR",
  "html_url": "https://github.com/opensensor/lightNVR/security/advisories/GHSA-pvw7-7j8c-qx96",
  "fix_commit": "https://github.com/opensensor/lightNVR/commit/507bce1c0715",
  "patched_version": "v0.44.3",
  "state": "published",
  "published_at": "2026-10-29T04:38:44Z",
  "updated_at": "2026-10-29T04:38:44Z",
  "cve_request_status": "Requested by maintainer (@matteius) via GitHub CNA on 2026-10-29",
  "summary": "Authorization Bypass via Pre-Decode Query-Parameter Truncation and Raw Query-String Forwarding in api_handlers_go2rtc_proxy.c",
  "severity": "high",
  "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
  "status": "Officially Published by Vendor (GHSA-pvw7-7j8c-qx96) • CVE Requested • Patched in v0.44.3 (507bce1c0715)",
  "credits": [
    {
      "login": "ccsimplyspolit",
      "type": "reporter",
      "state": "accepted"
    }
  ],
  "cwe_ids": [
    "CWE-285",
    "CWE-416"
  ]
}