Read the docs
TI-2026-25556 Aliases CVE-2026-33124

Frigate has insecure password change functionality

Priority MEDIUM 45CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Versions prior to 0.17.0-beta1 allow any authenticated user to change their own password without verifying the current password through the /users/{username}/password endpoint. Changing a password does not invalidate existing JWT tokens, and there is no validation of password strength. If an attacker obtains a valid session token (e.g., via accidentally exposed JWT, stolen cookie, XSS, compromised device, or sniffing over HTTP), they can change the victim’s password and gain permanent control of the account. Since password changes do not invalidate existing JWT tokens, session hijacks persist even after a password reset. Additionally, the lack of password strength validation exposes accounts to brute-force attacks. This issue has been resolved in version 0.17.0-beta1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00257 17th percentileScored 2026-11-07
Fix Fixed frigate (blakeblackshear): 0.17.0-beta1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
blakeblackshearfrigatebefore 0.17.0-beta10.17.0-beta1Patch availableCNA
  • frigate Vendorblakeblackshear Affected before 0.17.0-beta1 Fixed in 0.17.0-beta1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:frigate:frigate:*:*:*:*:*:*:*:*before 0.17.0Vulnerableblakeblackshear
  • cpe:2.3:a:frigate:frigate:*:*:*:*:*:*:*:* Versions before 0.17.0 Vulnerable ·blakeblackshear

Remediation

  • Fix · CNA frigate (blakeblackshear) Fixed in 0.17.0-beta1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33124

References

Patch 1

Advisory 1

  • TI-2026-20743 Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape CVSS 3.1CRITICAL 9.1
  • TI-2026-25557 Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts CVSS 3.1HIGH 8.1
  • TI-2026-25866 Missing authorization in blakeblackshear frigate CVSS 3.1MEDIUM 6.5
  • TI-2026-25865 Authenticated Frigate users can read the full unredacted configuration via `/api/config/raw CVSS 3.1MEDIUM 6.5
  • TI-2026-25558 Frigate has SSRF vulnerability in /ffprobe endpoint CVSS 3.1MEDIUM 5.0
  • TI-2023-24471 Frigate unsafe deserialization in `load_config_with_no_duplicates` of `frigate/util/builtin.py` CVSS 3.1HIGH 7.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences