{"id":"CVE-2026-71205","title":"changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements…","summary":"changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cwe":["CWE-307"],"published":"2026-08-05","updated":"2026-08-10","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71205","references":[{"url":"https://github.com/dgtlmoon/changedetection.io","label":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"tags":["nvd","exploit-available"],"epss":0.00266,"epssPercentile":0.16448,"ingestedAt":"2026-08-10T12:39:48.292Z","exploits":{"github":1,"githubRepos":["https://github.com/Nel-droid/CVE-2026-71205-PoC"],"checkedAt":"2026-09-25T08:21:10.518Z"},"exploitAvailable":true,"slug":"CVE-2026-71205","body":"## Overview\n\nchangedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":5455,"id":"CVE-2026-71205","ts":1788887284181,"field":"exploit_available","old":"false","new":"true"},{"seq":4338,"id":"CVE-2026-71205","ts":1788886398193,"field":"exploit_available","old":"true","new":"false"},{"seq":3067,"id":"CVE-2026-71205","ts":1788883061373,"field":"exploit_available","old":"false","new":"true"},{"seq":2096,"id":"CVE-2026-71205","ts":1788882466264,"field":"exploit_available","old":"true","new":"false"},{"seq":1162,"id":"CVE-2026-71205","ts":1788881903032,"field":"exploit_available","old":"false","new":"true"}]}