CVE-2026-71205
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).
Risk Assessment
An attacker can perform brute-force attacks on passwords without any restrictions, potentially leading to account takeover and data confidentiality breaches.
Recommendation
Update changedetection.io to a version with rate limiting and lockout mechanisms. If not possible, apply external protections such as a web application firewall or proxy with rate limiting.
Other vulnerabilities in changedetection.io
See all- CVE-2026-43891High
In the changedetection.io web page change detection tool prior to version 0.55.1, a vulnerability exists due to trusting attacker-controlled snapshot paths restored from backup files. When a backup is restored, the application may restore malicious files, including history.txt, leading to the disclosure of local file contents.
- CVE-2026-41895High
In versions 0.54.9 and earlier, changedetection.io switches to XML mode for XML/RSS content, leading to potential security issues related to processing untrusted XML data.
- CVE-2026-71204Medium
In changedetection.io, the /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update.
- CVE-2026-71203Medium
In changedetection.io, REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec, whose get method carries neither @auth.check_token nor @validate_openapi_request.
- CVE-2026-35000Medium
A vulnerability in ChangeDetection.io before version 0.54.7 allows bypassing protections in the SafeXPath3Parser. Attackers can read arbitrary local files using unblocked XPath 3.0/3.1 functions like json-doc().
Original NVD description (English source)
changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).