CVE-2026-33124: Frigate NVR Auth Bypass Vulnerability

CVE-2026-33124 Overview

CVE-2026-33124 is a high-severity authentication bypass vulnerability affecting Frigate, a popular open-source network video recorder (NVR) with realtime local object detection for IP cameras. The vulnerability allows any authenticated user to change their own password without verifying the current password through the /users/{username}/password endpoint. This design flaw, combined with inadequate session management and missing password strength validation, creates multiple attack vectors for account takeover.

Critical Impact
Attackers who obtain a valid session token can permanently take control of user accounts by changing passwords without verification, with session hijacking persisting even after password resets due to non-invalidated JWT tokens.

Affected Products

Frigate NVR versions prior to 0.17.0-beta1
All installations using the vulnerable /users/{username}/password endpoint
Deployments accessible over HTTP without TLS encryption

Discovery Timeline

March 20, 2026 - CVE-2026-33124 published to NVD
March 23, 2026 - Last updated in NVD database

Technical Details for CVE-2026-33124

Vulnerability Analysis

This vulnerability stems from improper authentication (CWE-287) in Frigate's user password management functionality. The core issue is that the password change endpoint does not require users to provide their current password as verification before setting a new one. This fundamentally breaks the security model that should prevent unauthorized password modifications.

The vulnerability is compounded by two additional security weaknesses. First, when a password is changed, existing JWT tokens remain valid rather than being invalidated. This means that even if a legitimate user changes their password after detecting suspicious activity, an attacker who has already obtained a session token retains access. Second, the absence of password strength validation allows attackers to set weak passwords, making accounts vulnerable to subsequent brute-force attacks.

Root Cause

The root cause is a missing authentication check in the password change workflow. The /users/{username}/password endpoint accepts password change requests from any authenticated session without validating that the requester knows the current password. This violates the security principle that sensitive account modifications should require re-authentication.

Attack Vector

This vulnerability is exploitable over the network by any attacker who obtains a valid JWT session token. Token acquisition can occur through multiple vectors including:

Accidental exposure of JWT tokens in logs or URLs
Stolen cookies from compromised browsers or devices
Cross-site scripting (XSS) attacks that exfiltrate tokens
Network sniffing when Frigate is deployed over HTTP without TLS
Compromised devices with active Frigate sessions

Once an attacker obtains a valid session token, they can invoke the password change endpoint to set a new password of their choosing. The victim loses access to their account while the attacker gains permanent control. Because JWT tokens are not invalidated upon password change, even if the victim regains access through an administrator and changes their password again, any previously compromised tokens remain valid for the attacker.

The attack is particularly dangerous in home surveillance and security camera deployments where Frigate is commonly used, as account takeover could provide attackers with access to live video feeds and recorded footage.

Detection Methods for CVE-2026-33124

Indicators of Compromise

Unexpected password change events in application logs without corresponding user activity
Multiple password changes for the same account in a short time period
Password modification requests originating from unusual IP addresses or geographic locations
Active sessions persisting after password resets
User reports of being locked out of accounts without initiating password changes

Detection Strategies

Monitor the /users/{username}/password endpoint for unusual request patterns or frequencies
Implement alerting for password change events, especially those occurring outside normal user activity windows
Track and correlate session token usage across multiple IP addresses that may indicate token theft
Review web server access logs for direct API calls to password change endpoints without preceding authentication flows

Monitoring Recommendations

Enable detailed logging for all authentication and account modification events in Frigate
Deploy network monitoring to detect HTTP traffic to Frigate instances that should be using HTTPS
Implement session activity tracking to identify tokens being used from multiple disparate locations
Configure alerts for bulk or automated requests to user management endpoints

How to Mitigate CVE-2026-33124

Immediate Actions Required

Upgrade Frigate to version 0.17.0-beta1 or later immediately
Force password resets for all user accounts after upgrading to ensure any compromised tokens are invalidated
Review access logs for signs of unauthorized password changes or suspicious session activity
Ensure Frigate is deployed behind HTTPS to prevent session token interception via network sniffing

Patch Information

This vulnerability has been resolved in Frigate version 0.17.0-beta1. The fix is available through the official GitHub commit. Additional details are provided in the GitHub Security Advisory GHSA-24p8-r573-vwr2. Organizations should update to the patched version as soon as possible.

Workarounds

Restrict network access to Frigate instances using firewall rules or VPN requirements until patching is complete
Implement a reverse proxy with additional authentication layers in front of Frigate
Disable or restrict access to the /users/{username}/password endpoint at the network level if the application cannot be immediately updated
Monitor all user accounts for suspicious activity and revoke sessions if compromise is suspected

bash

# Example: Restrict Frigate access to local network only using iptables
iptables -A INPUT -p tcp --dport 5000 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5000 -j DROP