changedetection.io’s /login route allows authentication by comparing a submitted password against a single PBKDF2‑HMAC‑SHA256 hash. The implementation lacks any per‑IP or per‑session rate limiting, a failed‑attempt counter, or lockout mechanism. Consequently, an attacker can brute‑force the shared administrator password at an unlimited rate. A successful guess grants full administrative access, enabling the attacker to view or regenerate the API token and to perform any action the admin user can. The weakness is classified as CWE‑307, which covers lack of rate limiting.

The affected product is changedetection.io by dgtlmoon. The CVE does not specify a particular software version; the vulnerability applies to any instance that uses the default single‑password authentication without additional rate limiting. Any deployment of the application that exposes the /login endpoint is potentially vulnerable.

The CVSS score is 5.3, indicating moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. The attack is remote, requiring only HTTP requests to the /login endpoint, and does not rely on privileged access or malicious code execution. Because no countermeasures are in place, brute‑forcing is effectively unlimited, giving attackers a high probability of success if password complexity is weak. Organizations should consider this a significant risk to confidentiality and integrity if the shared password is compromised.