CVE-2026-71205 in Changedetection.io
Summary
by MITRE • 08/05/2026
changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt). Because the entire application is protected by one shared password with no per-user accounts, a successful brute-force guess grants full administrative access, including the ability to view/regenerate the API token.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability in changedetection.io's authentication system represents a critical security flaw that undermines the application's entire access control mechanism. This issue stems from the absence of any rate limiting or account lockout mechanisms when processing login attempts through the /login endpoint. The system employs PBKDF2-HMAC-SHA256 hashing for password verification, which while cryptographically sound, becomes ineffective when combined with the lack of protective measures against automated attack vectors. The application's design uses a single shared administrative password across all users, eliminating any concept of individual account management or user-specific security controls.
The technical implementation fails to incorporate any form of rate limiting at either the IP address or session level, creating an environment where malicious actors can perform unlimited brute force attempts without restriction. This absence of protective mechanisms directly violates standard security practices outlined in the OWASP Authentication Cheat Sheet and aligns with CWE-307 - Improper Restriction of Excessive Authentication Attempts. Without per-IP tracking or failed attempt counters, attackers can systematically test password combinations at maximum speed, exponentially increasing their chances of success within a reasonable timeframe.
The operational impact of this vulnerability is severe and far-reaching, as successful exploitation grants complete administrative control over the entire application instance. This includes access to sensitive configuration data, ability to modify or delete monitored websites, and most critically the capacity to view and regenerate API tokens that provide programmatic access to all monitoring features. The shared password model means that any compromised credential immediately elevates an attacker's privileges to the highest level within the system, effectively providing a backdoor to all application functionalities.
Mitigation strategies should focus on implementing robust rate limiting controls at multiple levels including IP-based request throttling and session-specific attempt counters. The application requires integration of a proper rate limiting library such as flask-limiter or similar solutions that can be configured to track failed authentication attempts and temporarily block suspicious activity patterns. Additionally, the system should enforce minimum password complexity requirements and consider implementing multi-factor authentication mechanisms to reduce the risk associated with single-password exposure. The architectural approach should move away from shared credentials toward individual user accounts with proper access control management, aligning with NIST SP 800-63B authentication guidelines and ATT&CK technique T1110 - Brute Force.