Password Management Vulnerability in Frigate NVR by Blake Blackshear

CVE-2026-33124

What is CVE-2026-33124?

The Frigate network video recorder has a significant vulnerability where authenticated users can change their passwords without the need to verify their current password. This flaw exists in versions prior to 0.17.0-beta1 and enables an attacker, armed with a valid session token, to change victim passwords and maintain control over their accounts without detection. Additionally, existing JWT tokens remain valid post-password change, allowing session hijacking to persist. The absence of password strength validation makes accounts susceptible to brute-force attacks, posing an increased risk to user security.

References