CVE-2026-71205: changedetection.io Auth Bypass Vulnerability

CVE-2026-71205 Overview

CVE-2026-71205 affects changedetection.io, an open-source web change monitoring application. The /login route validates submitted passwords against a single PBKDF2-HMAC-SHA256 hash without any brute-force protections. The application ships with no per-IP rate limiting, no per-session throttling, no failed-attempt counter, and no account lockout. Because requirements.txt includes no rate-limiting library, remote attackers can submit unlimited password guesses. The entire application relies on one shared administrative password with no per-user accounts. A successful guess grants full administrative access, including the ability to view and regenerate the API token. The issue is classified under [CWE-307] Improper Restriction of Excessive Authentication Attempts.

Critical Impact
Unauthenticated remote attackers can brute-force the shared administrator password without lockout, leading to full application takeover and API token compromise.

Affected Products

changedetection.io (open-source web change monitoring application)
Instances exposing the /login route to untrusted networks
Deployments without an external reverse proxy enforcing rate limits

Discovery Timeline

2026-08-05 - CVE-2026-71205 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71205

Vulnerability Analysis

changedetection.io uses a single shared password to protect all administrative functions. The /login handler compares the submitted password against a stored PBKDF2-HMAC-SHA256 hash. While PBKDF2 slows individual hash comparisons, the server imposes no additional limits on the number of login attempts an unauthenticated client can submit. Attackers can script sustained credential-guessing directly against the network-accessible login endpoint. Successful authentication yields administrative access to watch configurations, notification settings, and the API token. Regenerating the API token from within the interface enables persistent programmatic access even if the password is later changed.

Root Cause

The root cause is missing brute-force protection on the authentication endpoint [CWE-307]. The application does not track failed login attempts per source IP address, per session, or globally. It does not implement exponential backoff, CAPTCHA challenges, or temporary lockouts. The dependency manifest confirms the absence of any rate-limiting middleware such as Flask-Limiter. Combined with the single-password model, this design gives attackers unlimited guesses against one credential.

Attack Vector

The attack requires only network reachability to the /login endpoint. An attacker submits repeated POST requests containing candidate passwords using standard credential-stuffing or dictionary-attack tooling. No user interaction is required, and no prior authentication is needed. Deployments exposed to the internet without an upstream proxy enforcing request throttling are directly reachable. Weak or common administrative passwords significantly reduce the time required to succeed. See the GitHub project for changedetection.io for technical details.

Detection Methods for CVE-2026-71205

Indicators of Compromise

High-volume POST requests to /login originating from a single IP address or distributed sources within a short window
Successful login events immediately followed by requests to API-token management pages
Unexpected regeneration of the API token or changes to notification and watch configurations
Access to administrative endpoints from geolocations or user-agent strings inconsistent with normal usage

Detection Strategies

Alert on repeated HTTP 200 or 302 responses from /login following a burst of failed attempts from the same source
Correlate authentication anomalies with subsequent API-token access or configuration changes
Baseline normal login volume per hour and trigger on statistically significant deviations

Monitoring Recommendations

Forward reverse proxy and application logs to a centralized logging platform for retention and correlation
Track requests to /login, /settings, and API-token endpoints with source IP, user-agent, and response code
Monitor for outbound traffic to unfamiliar destinations after suspicious login activity, indicating possible API-driven exfiltration

How to Mitigate CVE-2026-71205

Immediate Actions Required

Restrict access to the changedetection.io instance using network controls, VPN, or IP allow-listing until a fix is applied
Place the application behind a reverse proxy such as nginx, Caddy, or Traefik and enforce request rate limits on /login
Rotate the administrator password to a long, high-entropy value and regenerate the API token
Review logs for prior brute-force activity and unauthorized configuration changes

Patch Information

No specific patched version is referenced in the NVD entry at publication. Monitor the changedetection.io GitHub repository for security releases addressing rate limiting on the /login route.

Workarounds

Enforce rate limiting at the reverse proxy layer, for example using limit_req_zone in nginx to cap login attempts per IP
Require an additional authentication layer such as HTTP Basic Auth or client TLS certificates in front of the application
Deploy a Web Application Firewall (WAF) rule to block clients that exceed a threshold of failed /login responses
Bind the service to localhost and expose it only through an authenticated tunnel where remote access is unnecessary

bash

# nginx rate-limit example for /login
limit_req_zone $binary_remote_addr zone=cdio_login:10m rate=5r/m;

server {
    listen 443 ssl;
    server_name changedetection.example.com;

    location = /login {
        limit_req zone=cdio_login burst=3 nodelay;
        proxy_pass http://127.0.0.1:5000;
    }

    location / {
        proxy_pass http://127.0.0.1:5000;
    }
}