CVE-2026-33124 - Vulnerability Analysis

Overview

Frigate < 0.17.0-beta1 contains a broken authentication vulnerability caused by allowing authenticated users to change their password without current password verification and no password strength validation, letting attackers with a valid session token gain permanent account control, exploit requires valid session token.

Severity & Score

Impact

Attackers with a valid session token can change passwords and maintain persistent account access, leading to permanent account takeover.

Mitigation

Update to version 0.17.0-beta1 or later.

References

• https://github.com/blakeblackshear/frigate/commit/152e58520614610988bff3b6ff55d0aefd89c1b2
• https://github.com/blakeblackshear/frigate/security/advisories/GHSA-24p8-r573-vwr2

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner