EUVD-2026-53202
GHSA-vwqf-jx9p-3vgp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-accessible unauthenticated endpoint with no lockout; C:L/I:L reflects API token exposure and admin modification capability scoped to the application itself.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt). Because the entire application is protected by one shared password with no per-user accounts, a successful brute-force guess grants full administrative access, including the ability to view/regenerate the API token.
AnalysisAI
Unrestricted brute-force against changedetection.io's /login endpoint allows a remote unauthenticated attacker to systematically guess the single shared application password with no throttling, lockout, or attempt counter to impede automated attacks. Because the entire application is protected by one shared credential with no per-user account model, a successful guess grants full administrative control - including the ability to view and regenerate the API token and access all monitored URL configurations. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is trivially automatable given the network-accessible endpoint, low complexity (CVSS AC:L), and complete absence of brute-force controls confirmed by requirements.txt inspection.
Technical ContextAI
changedetection.io (CPE: cpe:2.3:a:dgtlmoon:changedetection.io:*:*:*:*:*:*:*:*) is an open-source, self-hosted web application for monitoring changes to web pages. Its /login route validates submitted passwords using PBKDF2-HMAC-SHA256, a cryptographically sound hashing algorithm, but applies no complementary brute-force protection. CWE-307 (Improper Restriction of Excessive Authentication Attempts) describes this exact failure pattern: the hashing primitive is not the weakness - the absence of per-IP rate limiting, failed-attempt counters, or account lockout is. Critically, the application's single-password architecture means there is no per-account lockout surface; the entire application is protected by one credential, so a single successful brute-force attempt yields complete administrative access rather than compromise of an individual account.
RemediationAI
No vendor-released patch has been identified at time of analysis. The project repository at https://github.com/dgtlmoon/changedetection.io should be monitored for upstream fixes addressing rate limiting on the /login route. As immediate compensating controls: place the instance behind a reverse proxy (e.g., nginx with limit_req_zone, Traefik with rate-limit middleware) configured to cap POST requests to /login per source IP - this directly addresses the missing application-level control with no application changes required, though aggressive limits may affect legitimate users on shared IPs. Restrict network exposure by binding changedetection.io to localhost or an internal-only interface, preventing public internet access entirely - this trades off remote accessibility. Ensure the application password is long, randomly generated, and unique, as high-entropy passwords substantially increase the computational cost of brute-force even under unlimited attempt conditions. Do not expose changedetection.io publicly without at least reverse-proxy rate limiting in place.
More in Changedetection Io
View allArbitrary local file disclosure in ChangeDetection.io versions before 0.54.7 allows authenticated attackers to read sens
Authentication bypass in changedetection.io's /settings endpoint silently disables REST API key enforcement when a privi
Unauthenticated retrieval of the full OpenAPI schema is possible in changedetection.io because the /api/v1/full-spec end
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today