Skip to content
Heist/ feed
Back to feed
Critical

Account takeover via prototype vulnerability

Type: advisorySources: OSV

NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patched in version 2.6.1. Users are advised to upgrade. Users unable to upgrade may cherry-pick commit `48d143921753914da45926cca6370a92ed0c46b8` into their codebase to patch the exploit.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2022-46164
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 15:32 UTC · Revision 1

Source evidence

Account takeover via prototype vulnerability

core-osv · Original source

Published 5 Dec 2022, 20:52 UTC

NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patched in version 2.6.1. Users are advised to upgrade. Users unable to upgrade may cherry-pick commit `48d143921753914da45926cca6370a92ed0c46b8` into their codebase to patch the exploit.

osv:CVE-2022-46164
Complete source record
{
  "id": "3a6c1c7dbbecdf1b6e1dcd2fcc1f501c1cb354de2062bfaadd6ceef9ade0cb8b",
  "url": "https://osv.dev/vulnerability/CVE-2022-46164",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Account takeover via prototype vulnerability",
    "summary": "NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patched in version 2.6.1. Users are advised to upgrade. Users unable to upgrade may cherry-pick commit `48d143921753914da45926cca6370a92ed0c46b8` into their codebase to patch the exploit.",
    "evidence": "osv:CVE-2022-46164",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2022-46164",
      "aliases": [
        "CVE-2022-46164",
        "GHSA-rf3g-v8p5-p675"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/nodebb/nodebb",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "f8e947e2a743151f54c2c3cd1c441bd16ff9e203"
                },
                {
                  "fixed": "48d143921753914da45926cca6370a92ed0c46b8"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:nodebb:nodebb:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.6.1"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "48d143921753914da45926cca6370a92ed0c46b8"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.6.0",
            "v2.4.0",
            "v2.3.1",
            "v2.3.0",
            "v2.2.5",
            "v2.2.4",
            "v2.2.3",
            "v2.2.2",
            "v2.2.1",
            "v2.2.0",
            "v2.1.1",
            "v2.1.0",
            "v2.0.1",
            "v1.19.7",
            "v1.19.6",
            "v1.19.4",
            "v1.17.0-beta.5",
            "v1.17.0-beta.4",
            "v1.17.0-beta.3",
            "v1.17.0-beta.2",
            "v1.17.0-beta.0",
            "v1.16.1-beta.0",
            "v1.15.3-beta.0",
            "v1.15.2-beta.1",
            "v1.15.2-beta.0",
            "v1.15.1",
            "v1.15.1-beta.0",
            "v1.15.0",
            "v1.15.0-rc.5",
            "v1.15.0-rc.4",
            "v1.15.0-rc.3",
            "v1.15.0-rc.1",
            "v1.15.0-rc.0",
            "v1.15.0-beta.30",
            "v1.15.0-beta.29",
            "v1.15.0-beta.27",
            "v1.15.0-beta.25",
            "v1.15.0-beta.24",
            "v1.15.0-beta.23",
            "v1.15.0-beta.22",
            "v1.15.0-beta.21",
            "v1.15.0-beta.19",
            "v1.15.0-beta.18",
            "v1.15.0-beta.17",
            "v1.15.0-beta.16",
            "v1.15.0-beta.15",
            "v1.15.0-beta.14",
            "v1.15.0-beta.13",
            "v1.15.0-beta.12",
            "v1.15.0-beta.11",
            "v1.15.0-beta.10",
            "v1.15.0-beta.9",
            "v1.15.0-beta.8",
            "v1.15.0-beta.7",
            "v1.15.0-beta.6",
            "v1.15.0-beta.5",
            "v1.15.0-beta.4",
            "v1.15.0-beta.3",
            "v1.15.0-beta.2",
            "v1.15.0-beta.1",
            "v1.15.0-beta.0",
            "v1.14.3-beta.16",
            "v1.14.3-beta.15",
            "v1.14.3-beta.14",
            "v1.14.3-beta.13",
            "v1.14.3-beta.12",
            "v1.14.3-beta.11",
            "v1.14.3-beta.10",
            "v1.14.3-beta.9",
            "v1.14.3-beta.8",
            "v1.14.3-beta.7",
            "v1.14.3-beta.6",
            "v1.14.3-beta.5",
            "v1.14.3-beta.4",
            "v1.14.3-beta.0",
            "v1.14.2-beta.1",
            "v1.14.1-beta.3",
            "v1.14.1-beta.1",
            "v1.14.1-beta.0",
            "v1.5.3",
            "v0.9.2",
            "v0.5.0-2",
            "v0.5.0-1",
            "v0.3.2",
            "v0.3.1",
            "v0.3.0",
            "v0.2.0",
            "v0.0.6",
            "v0.0.3"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-46164.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:36.822444785Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46164.json",
        "https://github.com/NodeBB/NodeBB/security/advisories/GHSA-rf3g-v8p5-p675",
        "https://nvd.nist.gov/vuln/detail/CVE-2022-46164",
        "https://github.com/NodeBB/NodeBB/commit/48d143921753914da45926cca6370a92ed0c46b8"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-665"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46164.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2022-46164",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 504164,
  "published_at": "2022-12-05T20:52:19.695+00:00"
}