This release includes 2 security fixes for security teams reviewing exposed deployments.
Published 3mo
Media Servers
✓ No known CVEs patched
This release patches 2 known CVEs
Topics
ffmpeg
lightweight
local-storage
nvr
opensource
privacy
+1 more
video-surveillance
Affected surfaces
auth
Summary
AI summaryCamera health monitoring with real‑time alerts and credential scrubbing in notifications.
Full changelog
Full Changelog: https://github.com/spupuz/VibeNVR/compare/v1.16.1...v1.16.2
v1.16.2 - Health Notifications & Security Improvements
✨ New Features
Camera Health Monitoring
- Real-time Health Status Detection: Engine now monitors camera connectivity and authentication status in real-time
- Immediate Notifications: Get instant alerts when cameras go offline or have authentication issues
- Recovery Alerts: Receive notifications when cameras come back online (✅ Camera Recovered)
Polished Notification Messages
- Health status notifications now include emojis for better visibility:
- 🚫 Camera Authentication Failed - Wrong password/credentials
- 📡 Camera Offline - Network unreachable
- ✅ Camera Recovered - Camera back online
- User-friendly error messages replace raw technical output
Notification Debouncing
- Alerts are sent only when camera status changes, preventing notification spam
- Single notification per status change (problem detected → problem resolved)
Per-Camera Health Notification Settings
- Configure separate notification channels for health events vs motion events
- Individual Telegram, Email, and Webhook settings for health alerts
- Global settings fallback when camera-specific settings are not configured
Test Notification Buttons
- Added "Test" buttons for all notification types in Camera Edit modal
- Standardized button styling across Email, Telegram, and Webhook tests
- Supports partial override (e.g., Camera Recipient + Global SMTP)
🐛 Bug Fixes
- Fixed
AttributeError: 'StreamReader' object has no attribute 'last_health_report_status' - Fixed duplicate
<button>tags in Cameras.jsx causing syntax errors - Improved 401/403 authentication error detection with curl fallback
- Fixed StreamReader callback not triggering for UNAUTHORIZED status
🔒 Security Improvements
- Credential Scrubbing: Sensitive RTSP credentials (username/password) are now sanitized from all notification messages
- Debug Script Removal: Removed insecure
backend/debug_conn.pythat could expose credentials - URL sanitization: Double slashes in RTSP paths are now properly cleaned
🎨 UI Improvements
- Removed redundant "NO SIGNAL" and "INVALID PASSWORD" text overlays from LiveView (status badges already show this info)
- Added
invalid-password.pngplaceholder image for authentication errors - Consistent "Test" button styling with bordered design, hover effects, and shadows
📁 Files Changed
New Files
- backend/health_service.py - Background service for camera health monitoring
- frontend/public/invalid-password.png - Placeholder image for auth errors
Modified Files
- engine/camera_thread.py - Health status detection, debouncing, emojis
- engine/core.py - Health service integration
- engine/main.py - Health endpoints
- backend/models.py - Health notification columns
- backend/schemas.py - Health notification schemas
- backend/routers/events.py - Health event webhook handler
- backend/routers/settings.py - Test notification endpoint
- backend/routers/cameras.py - Camera health fields
- backend/migrate_db.py - Database migration for new columns
- backend/main.py - Health service startup
- frontend/src/pages/Cameras.jsx - Per-event notification UI, test buttons
- frontend/src/pages/LiveView.jsx - Auth error placeholder, removed redundant overlays
- frontend/src/pages/Settings.jsx - Global webhook URL setting
Security Fixes
- Sensitive RTSP credentials are now sanitized from all notification messages
- Removed insecure backend/debug_conn.py script that could expose credentials
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About spupuz/VibeNVR
All releases →Related context
Related tools
Earlier breaking changes
- v1.28.3 Must update docker-compose.yml with TZ variable for all services
Beta — feedback welcome: [email protected]