CVE-2026-71205 describes a weakness in changedetection.io's /login endpoint in version 0.55.7. The application verifies submitted passwords against a single PBKDF2-HMAC-SHA256 hash but lacks any form of rate limiting, failed login attempt tracking, or account lockout. No rate-limiting library is included in the software dependencies, which means attackers can perform unlimited authentication attempts without restriction. This improper restriction of excessive authentication attempts corresponds to CWE-307.

The absence of rate limiting and lockout mechanisms allows attackers to perform brute-force or credential stuffing attacks against user accounts. While the password hashing algorithm (PBKDF2-HMAC-SHA256) provides some defense, unlimited attempts increase the likelihood of successful unauthorized access. The CVSS score of 6.5 (medium severity) reflects the network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality and integrity impact.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, consider implementing external protections such as web application firewalls (WAF) with rate limiting rules or reverse proxies that can throttle repeated login attempts. Avoid relying solely on the application to prevent brute-force attacks.