CVE-2026-71205: medium-severity vulnerability in dgtlmoon changedetection.io
changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.5epss 0.3%
from disclosure to weapon11 days
Published on NVDAug 5
1st PoC+11d
changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
dgtlmoon · changedetection.iopublic PoCs found — 1
githubgithub.com/Nel-droid/CVE-2026-71205-PoC★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — dgtlmoon changedetection.io
In the same product, most dangerous first.
CVE-2024-32651CRITICALServer Side Template Injection in Jinja2 allows Remote Command ExecutionEPSS 85.3%CVE-2024-51483MEDIUMchangedetection.io Path Traversal vulnerabilityEPSS 2.3%CVE-2024-34061MEDIUMReflected cross site scripting in changedetection.ioEPSS 1.3%CVE-2026-25527MEDIUMchangedetection.io vulnerable to unauthenticated static path traversalEPSS 1.0%CVE-2024-56509HIGHchangedetection.io has Improper Input Validation Leading to LFR/Path TraversalEPSS 0.7%CVE-2024-51998HIGHPath traversal using file URI scheme without supplying hostname in changedetection.ioEPSS 0.7%