{"id":"CVE-2026-71205","aliases":["EUVD-2026-53202","GHSA-vwqf-jx9p-3vgp"],"status":"published","title":"changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force","description":"changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00266,"percentile":0.18689,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-307"],"published":"2026-08-05T06:59:03Z","modified":"2026-10-28T02:30:34Z","exploits":[{"source":"pocgithub","id":"Nel-droid/CVE-2026-71205-PoC","title":"Nel-droid/CVE-2026-71205-PoC","date":"2026-08-16","url":"https://github.com/Nel-droid/CVE-2026-71205-PoC"}],"products":[{"vendor":"dgtlmoon","product":"changedetection.io"}],"references":[{"url":"https://github.com/dgtlmoon/changedetection.io","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71205","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vwqf-jx9p-3vgp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71205.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-71205","title":"changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force","description":"changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).","status":"published","published":"2026-08-05T06:59:03.879Z","modified":"2026-08-10T11:45:05.236Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T14:19:49.559463Z"}],"euvd":[{"id":"EUVD-2026-53202","description":"changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).","status":"published","published":"2026-08-05T06:59:03Z","modified":"2026-08-10T11:45:05Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:06.086083Z"}],"ghsa":[{"id":"GHSA-vwqf-jx9p-3vgp","title":"changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC...","description":"changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt). Because the entire application is protected by one shared password with no per-user accounts, a successful brute-force guess grants full administrative access, including the ability to view/regenerate the API token.","status":"published","published":"2026-08-05T09:31:18Z","modified":"2026-08-05T09:31:27Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T15:10:06.632203Z"}],"nvd":[{"id":"CVE-2026-71205","description":"changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).","status":"published","published":"2026-08-05T08:16:42.463Z","modified":"2026-10-24T15:10:00.19Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T14:12:35.031043Z"}],"osv":[{"id":"CVE-2026-71205","title":"changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force","description":"changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).","status":"published","published":"2026-08-05T06:59:03.879Z","modified":"2026-10-28T02:30:34.803175887Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T15:45:15.164658Z"}]}}