0.44.0

🚨 This release closes a number of security vulnerabilities, please update ASAP! 🚀

The following vulnerabilities have been closed:

• CVE-2026-46488
• CVE-2026-55863
• CVE-2026-32315
• CVE-2026-31978
• CVE-2026-55488

Their combination allowed the following attacks, for which every step has been mitigated:

• GHSA-qxvg-h7q2-hcxh
• GHSA-phv5-334h-mxcw

Breaking changes: #3332 @motioneye-project

• The signature authentication method has been replaced with session cookies. For using the API, a session cookie needs to be obtained by doing a POST request to the /login API, with username and password arguments as POST data/parameters. If credentials were correct, a session cookie is returned, which needs to be sent with the actual API requests. The cookie has a 24h lifetime, hence scripts/programs should automatically redo the login loop when receiving a 403.
  • This addresses CVE-2026-46488, parts of GHSA-qxvg-h7q2-hcxh, and GHSA-phv5-334h-mxcw.
• For remote motionEye cameras exclusively, a HMAC authentication method has been added, generating a signature from a dedicated secret, request URL, nonce, and tight timestamp. This secret is automatically generated for every motionEye instance, and needs to be entered when adding a remote motionEye camera. Implicitly, motionEye v0.44.0 instances cannot work with older versions vice versa. On first admin login after the update, respectively when selecting the remote motionEye camera from the settings panel, a prompt will allow you to enter the new secret. A new button in the settings panel allows to change it any time later, in case it changes at the remote motionEye instance.
• The HTTP basic authentication option has been removed.
• Passwords are now enforced for both users: admin and surveillance/normal, and stored as Argon2 hash on the server. Existing SHA1 hashes and plain text passwords are still functional, and migrated automatically on login. Users are asked to apply passwords on login, if none applied yet.
  • This addresses parts of GHSA-phv5-334h-mxcw.
• The /action API does now require authentication.
  • This addresses CVE-2026-55863 and parts of GHSA-qxvg-h7q2-hcxh.

Other changes

• S3 uploads do now work with and without path elements in the filename, and the "Include Subdirectories" slider has an actual effect:
  • #2760 @pbouill @MichaIng
• The exception it a remote motionEye instance does not respond to HTTP requests at all is now properly handled:
  • #3079 @Matthew1471
• It is now possible to do S3 uploads with SSE-C server-side encryption enabled, defining the base64-encoded key:
  • #3192 @tuxgasy
• Cameras can now be flagged as admin-only, which hides them from the normal/surveillance user GUI and requires admin credentials to access their API:
  • #3245 @Marijn0
• The picture/ID/current API has been fixed for requests which are not done within mjpg_client_idle_timeout (default: 10) seconds after another:
  • #3253 @Marijn0
• Python 3.14 compatibility has been fixed:
  • #3254 @ddxtanx
• Accessing camera streaming with digest authentication enabled has been fixed @MichaIng:
  • #3265
  • #3266
• Streaming access is not automatically done via normal/surveillance user credentials anymore, instead one needs to enter username and password for each streamed camera individually. In the same turn, streaming is disabled by default, and needs to be enabled explicitly. On motionEye upgrade, existing camera re-streams are not affected, but we recommend to check whether re-streaming is needed, and if so, to apply individual credentials for each camera:
  • #3268 @Marijn0
• Our CI/CD tests have been hardened and extended, applying certain coding standards and typing across our code more widely:
  • #3271 @MichaIng
• Our frontend went through some major cleanup: removing obsolete scripts, updating all other scripts, updating or jQuery methods, or switching to vanilla JavaScript, and merging some of the frontend input validators to reduce the number of event listeners @MichaIng:
  • #3275
  • #3277
  • #3280
  • #3282
  • #3284
  • #3285
• Passwords and usernames with special characters for RTSP network cameras do not cause authentication issues anymore:
  • #3296 @Marijn0
• The motion configuration files are now created and stored with 0600 UNIX mode, to prevent read access for anyone but the motionEye daemon user and root @MichaIng:
  • #3311
  • #3316
  • This addresses CVE-2026-32315.
• Any file or directory paths passed via API requests or internally do now cause a 403 response or exception respectively, when containing traversal path elements:
  • #3313 @MichaIng
  • This addresses CVE-2026-31978.
• Fixed monitor info text on camera frames being wrapped into double quotes with extra backslash character \"\":
  • #3322 @Marijn0
• The input path validation at the backend has been extended, to prevent any kind of escaping the camera data dir:
  • #3324 @MichaIng
  • This addresses CVE-2026-55488, parts of GHSA-qxvg-h7q2-hcxh, and GHSA-phv5-334h-mxcw.
• The backup/restore feature is now limited to those config files which are actually generated by the web interface: motion.conf, camera-*.conf, prefs.json, and mask-*.pgm. Files that need to be created from console, like motioneye.conf and camera action scripts, are not included, and won't be restored anymore, if present in old backups:
  • #3338 @MichaIng
  • This addresses parts of GHSA-qxvg-h7q2-hcxh.
• A new button and dialog was added to change credentials for network cameras, including simple MJPEG cameras, and remote motionEye cameras. It is hence not needed anymore to remove and re-add a camera for this. If the connection to a remote motionEye camera fails, the dialog pops up automatically, which simplifies applying the new remote/client secret, required since motionEye 0.44.0b2:
  • #3353 @Marijn0
• An issue has been solved where passwords changed in the settings panel without manually typing into the input box, e.g. by letting a password manager auto-fill it, were not applied:
  • #3347 @Marijn0
• The aspect ratio of the camera placeholder icon has been fixed:
  • #3350 @Marijn0
• The name of the admin user can now be changed in the settings panel:
  • #3298 @strawberry-poodle (anonymous study account)
• The motion %$ conversion specifier to reference the camera name can now be used in media filenames:
  • #3273 @strawberry-poodle (anonymous study account)
• When restoring backups, the file type and paths are now checked more strictly, to assure that only real files are extracted to the root of the config dir, and nowhere else:
  • #3341 @MichaIng
• .mpg files inside the camera media directories are not treated as movie files regarding preview generation, cleanup, and similar tasks. Available motionEye options do not currently generate those files, but with custom settings, manual conversions, media files copied from elsewhere, the situation is generally possible:
  • #3300 @strawberry-poodle (anonymous study account)
• Preview images for movie files with less than 4 seconds duration are now generated:
  • #3304 @strawberry-poodle (anonymous study account)
• Several translations have been updated, and an initial addition of the Bulgarian language was done. Many thanks to all @weblate contributors! ❤️

0.44.0b3

What's new

• A new button and dialog was added to change credentials for network cameras, including simple MJPEG cameras, and remote motionEye cameras. It is hence not needed anymore to remove and re-add a camera for this. If the connection to a remote motionEye camera fails, the dialog pops up automatically, which simplifies applying the new remote/client secret, required since motionEye 0.44.0b2: #3353 @Marijn0
• An issue has been solved where passwords changed in the settings panel without manually typing into the input box, e.g. by letting a password manager auto-fill it, were not applied: #3347 @Marijn0
• The aspect ratio of the camera placeholder icon has been fixed: #3350 @Marijn0
• The name of the admin user can now be changed in the settings panel: #3298 @strawberry-poodle (anonymous study account)
• The motion %$ conversion specifier to reference the camera name can now be used in media filenames: #3273 @strawberry-poodle (anonymous study account)
• When restoring backups, the file type and paths are now checked more strictly, to assure that only real files are extracted to the root of the config dir, and nowhere else: #3341 @MichaIng
• .mpg files inside the camera media directories are not treated as movie files regarding preview generation, cleanup, and similar tasks. Available motionEye options do not currently generate those files, but with custom settings, manual conversions, media files copied from elsewhere, the situation is generally possible: #3300 @strawberry-poodle (anonymous study account)
• Preview images for movie files with less than 4 seconds duration are now generated: #3304 @strawberry-poodle (anonymous study account)
• As always, several translations have been updated. Many thanks to all @weblate contributors! ❤️

0.44.0b2

Breaking changes: #3332 @motioneye-project

• The signature authentication method has been replaced with session cookies. For using the API, a session cookie needs to be obtained by doing a POST request to the /login API, with username and password arguments as POST data/parameters. If credentials were correct, a session cookie is returned, which needs to be sent with the actual API requests. The cookie has a 24h lifetime, hence scripts/programs should automatically redo the login loop when receiving a 403.
• For remote motionEye cameras exclusively, a HMAC authentication method has been added, generating a signature from a dedicated secret, request URL, nonce, and tight timestamp. This secret is automatically generated for every motionEye instance, and needs to be entered when adding a remote motionEye camera. Implicitly, motionEye v0.44.0 instances cannot work with older versions vice versa, and for now, remote motionEye cameras need to be removed, and readded with the secret. But we aim to expose an input field for the secret in the camera settings panel, so that it can be added and changed, without the need to remove and readd the camera as a whole.
• The HTTP basic authentication option has been removed.
• Passwords are now enforced for both users: admin and surveillance/normal, and stored as Argon2 hash on the server. Existing SHA1 hashes and plain text passwords are still functional, and migrated automatically on login. Users are asked to apply passwords on login, if none applied yet.

Other changes

• Fixed monitor info text on camera frames being wrapped into double quotes with extra backslash character \"\": #3322 @Marijn0
• The input path validation at the backend has been extended, to prevent any kind of escaping the camera data dir: #3324 @MichaIng
• The backup/restore feature is now limited to those config files which are actually generated by the web interface: motion.conf, camera-*.conf, prefs.json, and mask-*.pgm. Files that need to be created from console, like motioneye.conf and camera action scripts, are not included, and won't be restored anymore, if present in old backups: #3338 @MichaIng
• Several translations have been updated, and an initial addition of the Bulgarian language was done. Many thanks to all @weblate contributors! ❤️

0.44.0b1

Whats new:

• S3 uploads do now work with and without path elements in the filename, and the "Include Subdirectories" slider has an actual effect:
  • #2760 @pbouill @MichaIng
• The exception it a remote motionEye instance does not respond to HTTP requests at all is now properly handled:
  • #3079 @Matthew1471
• It is now possible to do S3 uploads with SSE-C server-side encryption enabled, defining the base64-encoded key:
  • #3192 @tuxgasy
• Cameras can now be flagged as admin-only, which hides them from the normal/surveillance user GUI and requires admin credentials to access their API:
  • #3245 @Marijn0
• The picture/ID/current API has been fixed for requests which are not done within mjpg_client_idle_timeout (default: 10) seconds after another:
  • #3253 @Marijn0
• Python 3.14 compatibility has been fixed:
  • #3254 @ddxtanx
• Accessing camera streaming with digest authentication enabled has been fixed @MichaIng:
  • #3265
  • #3266
• Streaming access is not automatically done via normal/surveillance user credentials anymore, instead one needs to enter username and password for each streamed camera individually. In the same turn, streaming is disabled by default, and needs to be enabled explicitly. On motionEye upgrade, existing camera re-streams are not affected, but we recommend to check whether re-streaming is needed, and if so, to apply individual credentials for each camera:
  • #3268 @Marijn0
• Our CI/CD tests have been hardened and extended, applying certain coding standards and typing across our code more widely:
  • #3271 @MichaIng
• Our frontend went through some major cleanup: removing obsolete scripts, updating all other scripts, updating or jQuery methods, or switching to vanilla JavaScript, and merging some of the frontend input validators to reduce the number of event listeners @MichaIng:
  • #3275
  • #3277
  • #3280
  • #3282
  • #3284
  • #3285
• Passwords and usernames with special characters for RTSP network cameras do not cause authentication issues anymore:
  • #3296 @Marijn0
• API requests via basic authentication with http_basic_auth true in motioneye.conf do not fail anymore:
  • #3301 @hajekj
• The motion configuration files are now created and stored with 0600 UNIX mode, to prevent read access for anyone but the motionEye daemon user and root @MichaIng:
  • #3311
  • #3316
• Any file or directory paths passed via API requests or internally do now cause a 403 response or exception respectively, when containing traversal path elements:
  • #3313 @MichaIng
• Several translation updates, many thanks to all @weblate contributors ❤️

🚨 Since this version contains a number of security-related changes, we highly recommend to update your instances ASAP 🚀.

0.43.1

First stable 0.43.1 release!

To see what's new since the last stable 0.42.1, see the previous beta release notes:

• https://github.com/motioneye-project/motioneye/releases/tag/0.43.1b1
• https://github.com/motioneye-project/motioneye/releases/tag/0.43.1b2
• https://github.com/motioneye-project/motioneye/releases/tag/0.43.1b3
• https://github.com/motioneye-project/motioneye/releases/tag/0.43.1b4
• https://github.com/motioneye-project/motioneye/releases/tag/0.43.1b5

What's new since 0.43.1b5:

• The /picture/ID/list and /movie/ID/list media file list API have been extended by a new optional boolean with_stat query parameter, which defaults to true, preserving the previous behavior. If set to with_stat=false, the returned data object contains only the data.path element, no data.timestamp, data.sizeStr, etc. This speeds up processing time and reduces request size by at least a magnitude of order, and hence reduces the chance to run into the list_media_timeout timeout defined in motioneye.conf. This is internally used for the initial recursive file list requested when opening the picture/movie browser on camera panels, when generating a time-lapse movie, downloading or deleting all media files in a directory, speeding up each of these tasks significantly: #3225 @MichaIng
• Also behind the scenes, the Python code to loop through the files and obtain the info has been unified and enhanced, to speed up the calls: #3215 #3219 @MichaIng
• Translated strings inside HTML documents are now assured to be HTML-escaped: #3239 @MichaIng
• Several translation updates, many thanks to all @weblate contributors ❤️
• Some major polishing on our Weblate translation repository has been done: with Nepali being the only exception, all languages got all missing strings machine-translated, and all machine-translated backend/Python strings are now used by motionEye. Previously, those, which are marked as "needs editing", were not compiled, hence Esperanto source strings were shown instead. However, note that the quality of those machine-translated strings varies. We have no costly API key for proper translation services like DeepL, hence LibreTranslate is used, which ... has mixed results 😅. But I spent some time to address nearly all annotations of Weblate's quality checks, which includes a lot of formal things like correct spacing, consistent punctuation, Python format variables, as well as word repetition and similar things, which includes most bad machine-translation results. For some languages, LibreTranslate does not work, in which case I used DeepL manually. Only for Nepali, with close to 500 missing strings, the work would have been too much, bear with me. The machine-translated strings do not contribute to the completion percentage, show up as "unfinished words" with a "needs editing" mark.
  => So please everyone, check out our Weblate repo, and help to finish or polish the translation for your language. Let's make motionEye a pleasure to use for people of any language and culture 🙂. @MichaIng

0.43.1b5

What's new:

• All metadata for Python builds and packaging have been migrated to pyproject.toml, following PEP 621 and PEP 639 for license definition. This raised the minimum setuptools requirement for building the wheel to 77.0.3 and hence the minimum Python version to 3.9. Pre-compiled wheels e.g. installed via pip from PyPI however still work with Python 3.7: #3149 @MichaIng
• The test button for testing notification email settings has been fixed, in case multiple receiver email addresses were added: #3170 @MichaIng
• Closed a security vulnerability, published as GHSA-j945-qm58-4gjx and CVE-2025-60787, which allows RCE for admin-authenticated users with crafted inputs, executed as shell code by motion's event action feature. Inputs were not checked in the backend, but only in the frontend, which can be manipulated at the client side. To address the issue, the same limitations and input checks done by the frontend have been added to the backend to mitigate the issue: #3203 @prabhatverma47 @MichaIng
• Nepali language has been added: #3174 @sangampaudel530
• Danish language has been added: #3190 @Tbnilen
• Several translation updates, many thanks to all @weblate contributors ❤️

0.43.1b4

What's new:

• Closed an important security vulnerability, which allowed remote code execution via motionEye API: #3142 @hyperlyz @MichaIng

We highly recommend everyone on any previous 0.43.1 beta to update to this release ASAP, updating your container image, respectively updating a bare metal pip-based installation via:

sudo systemctl stop motioneye
sudo python3 -m pip install --upgrade --pre motioneye
sudo systemctl start motioneye

0.43.1b3

What's new:

• Added Docker images for riscv64 architecture: #3133 @MichaIng
• Fixed a bug where the noise level setting changed due to inconsistent rounding when saving and reading back settings: #3084 @zagrim
• Added support for distros where meyectl is not installed to /usr/local/bin/meyectl, notably Arch Linux, to the systemd unit installed via motioneye_init command: #3011 @MichaIng
• Added Python 3.13 support: #3092 @mosquito
• Message-ID is now added to emails to fix possibly rejections by email servers: #3030 @donlorenzo
• Added Tamil language: #3099 @TamilNeram
• Added Vietnamese language: #3124 @thanhtantran
• Several translation updates, many thanks to all @weblate contributors ❤️

0.43.1b2

What's new:

• Restored authentication with surveillance user: #2944 @zagrim
• Conflicting motion.service is now disabled by motioneye_init execution: #2980 @MichaIng
• Turkish language added: #2965 @ToramanO (I hope the GitHub account is correct 😉)
• Restored working schedule functionality: #2987 @zagrim
• Optimised camera button display, allowing up to 16 action buttons: #2903 @sevimuelli

0.43.1b1

What's new:

• BREAKING: motionEye requires now Python 3.7 or later and does not support Python 2 anymore.
• Multi-language support has been added. You can contribute to translations on Weblate.
• Support for motion 4.4 - 4.6 has been added: #2462
  Remember to update your custom options in case: https://motion-project.github.io/motion_config.html#Configuration_OptionsAlpha
• Support for WebDAV uploads has been added: #1743
• Support for S3 uploads has been added: #2376
• A long list of larger and smaller enhancements and bug fixes, too many to list them here.