CyberRota Analysis
AI-GeneratedThe vulnerability exists in changedetection.io's login mechanism, which relies on a single PBKDF2-HMAC-SHA256 hash for password verification without implementing per-IP or per-session rate limiting or account lockout features. This lack of security measures allows attackers to perform brute-force attacks, potentially gaining full administrative access to the application, including the ability to manage API tokens. Organizations using this application should prioritize addressing this vulnerability to prevent unauthorized access and potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).