CVE-2026-71205 in Changedetection.io
Zusammenfassung
von MITRE • 05.08.2026
changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt). Because the entire application is protected by one shared password with no per-user accounts, a successful brute-force guess grants full administrative access, including the ability to view/regenerate the API token.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.