CVE-2022-46164: NodeBB socket.io prototype handling allows account takeover

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required and high EPSS probability makes this an urgent account takeover risk.

What it is

NodeBB uses a plain object with a prototype in socket.io message handling, so a specially crafted payload can impersonate other users and take over accounts. The flaw is network-reachable with no privileges or user interaction required, and it is patched in version 2.6.1.

Impact

An unauthenticated attacker can impersonate arbitrary users and take over their accounts, gaining full control of forum identities and any privileges those accounts hold.

Attack surface

Reached over the network through the socket.io message handling path; the CVSS vector indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no public exploit tag is present in the references, but EPSS is high at roughly 0.49 probability (98.8th percentile), indicating elevated likelihood of attempted exploitation.

What to do

• Upgrade NodeBB to version 2.6.1 or later.
• If upgrading is not possible, cherry-pick commit 48d143921753914da45926cca6370a92ed0c46b8 into the codebase.
• Restrict or monitor external access to the socket.io endpoint until patched.
• Review forum accounts for signs of unauthorized impersonation or takeover after exposure.

Detection

• Monitor socket.io message traffic for crafted payloads that manipulate object prototypes.
• Alert on unexpected account session or identity changes, especially for privileged accounts.
• Audit authentication and session logs for logins or actions inconsistent with the legitimate account owner.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.