The vulnerability allows an authenticated user to change their own password without confirming the current password through the /users/{username}/password endpoint. The change does not invalidate existing JSON Web Tokens (JWTs) and there is no enforcement of password strength. Consequently, an attacker who gains access to a valid session token—through exposed JWTs, stolen cookies, cross‑site scripting, device compromise, or network sniffing—can change the victim’s password, lock out the original owner, and maintain permanent control over the account. This is a classic authentication bypass flaw identified as CWE‑287.

Frigate, the open‑source network video recorder produced by blakeblackshear, is affected in all releases prior to 0.17.0-beta1. Users on those versions are vulnerable; upgrading to 0.17.0-beta1 or later resolves the issue.

The vulnerability has a CVSS score of 8.6, indicating high severity. The EPSS probability is under 1%, suggesting that exploitation is uncommon, and the flaw is not listed in the CISA KEV catalog. An attacker requires a valid authenticated session; once obtained, they can exploit the unauthorized password change and the continued validity of the JWT to hijack the account permanently. The lack of password strength validation also facilitates brute‑force attempts to compromise legitimate user credentials.