CVE-2022-46164 - CVE House
Back to Database
Status published Critical CVE-2022-46164

Account takeover via prototype vulnerability

Vulnerability Description

NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patched in version 2.6.1. Users are advised to upgrade. Users unable to upgrade may cherry-pick commit `48d143921753914da45926cca6370a92ed0c46b8` into their codebase to patch the exploit.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-46164

Credits & Attribution

No credits recorded in the NVD database.

References

More from NodeBB

View All →
CVE-2023-2850
NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due...
Medium 4.7
CVE-2023-26045
NodeBB vulnerable to path traversal and code execution via prototype vulnerability
Critical 10
CVE-2022-36076
Account takeover via SSO plugins in NodeBB
High 8.8
CVE-2022-36045
Account takeover via cryptographically weak PRNG in NodeBB Forum
Critical 9
CVE-2021-47746
NodeBB Plugin Emoji 3.2.1 - Arbitrary File Write
High 8.6

Affected Vendor

Affected Software

NodeBB
Vulnerable Versions:
< 2.6.1

Timeline

Official Publish: December 5th, 2022
Last Modified: April 23rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Weaknesses (CWE)

CWE-665

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.