CVE-2026-71205

Name of the Vulnerable Software and Affected Versions changedetection.io (affected versions not specified)

Description The '/login' endpoint fails to implement per-IP or per-session rate limiting, failed-attempt counters, or account lockouts when verifying passwords against a PBKDF2-HMAC-SHA256 hash. Since the application uses a single shared password instead of individual user accounts, a successful brute-force attack allows an attacker to gain full administrative access, which includes the ability to view or regenerate the API token.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.