The vulnerability in changedetection.io 0.55.7 involves the /login endpoint which verifies the submitted password against a single PBKDF2-HMAC-SHA256 hash. There is no implementation of per-IP or per-session rate limiting, failed-attempt counters, or account lockout mechanisms. Because the entire application is protected by one shared password without individual user accounts, a successful brute-force attack on this password grants full administrative privileges, including the ability to view or regenerate the API token. This represents an improper restriction of excessive authentication attempts (CWE-307). No patch or official fix has been published as of the vulnerability disclosure date.

An attacker can perform unlimited password guessing attempts against the single shared password without any rate limiting or lockout, increasing the likelihood of a successful brute-force attack. Successful exploitation results in full administrative access to the application, including viewing and regenerating the API token, which could lead to unauthorized control over the service. The vulnerability does not impact availability but compromises confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing external rate limiting or access controls at the network or application proxy level to mitigate brute-force attempts. Additionally, migrating to a model with per-user accounts and proper authentication controls would reduce risk.