What is GHSA-rr4v-3p4h-3928?

GHSA-rr4v-3p4h-3928 is a security advisory published by GitHub Security Advisories with Medium severity. mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving...

Which CVE IDs does GHSA-rr4v-3p4h-3928 cover?

GHSA-rr4v-3p4h-3928 covers the following CVE IDs: CVE-2026-82930. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-rr4v-3p4h-3928Medium

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving...

Vendor

GitHub Security Advisories

Published

September 28, 2026

Last Modified

September 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-82930 →

📋 Description

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to manipulate building automation devices. This issue was fixed in version 3.0.30

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-82930
https://cert.pl/posts/2026/09/CVE-2026-82928
https://www.fif.com.pl/pl/strona-glowna/1367-mh-developer.html
https://github.com/advisories/GHSA-rr4v-3p4h-3928