changedetection.io’s /login route authenticates a user by checking the submitted password against a single PBKDF2‑HMAC‑SHA256 hash. This implementation omits per‑IP or per‑session rate limiting, a failed‑attempt counter, or lockout policy. As a result, an attacker can perform unlimited password brute‑force attempts against the shared administrator credential. Successfully guessing the password grants full administrative privileges, allowing the attacker to view or regenerate the API token and perform any action an admin can. This weakness is classified as CWE‑307, which denotes a lack of rate limiting.

The affected product is changedetection.io by dgtlmoon. The CVE does not specify a particular software version; the vulnerability applies to any instance that uses the default single‑password authentication without additional rate limiting. Any deployment of the application that exposes the /login endpoint is potentially vulnerable.

The CVSS score is 6.5, indicating medium severity. EPSS is < 1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. The attack is remote, requiring only HTTP requests to the /login endpoint, and does not rely on privileged access or malicious code execution. Because no countermeasures are in place, brute‑forcing is effectively unlimited, giving attackers a high probability of success if password complexity is weak. Organizations should consider this a significant risk to confidentiality and integrity if the shared password is compromised.