CVE-2026-33124

High

Published: 20 March 2026

Published

20 March 2026

Modified

23 March 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0005 16.5th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-33124 is a high-severity Improper Authentication (CWE-287) vulnerability in Frigate Frigate. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-12 (Session Termination) and IA-11 (Re-authentication).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 3 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

IA-11 Re-authentication good match

prevent

Requires re-authentication for privileged actions like password changes, preventing attackers with stolen session tokens from altering passwords without knowing the current one.

IA-5 Authenticator Management good match

prevent

Enforces secure authenticator management including password strength requirements and procedures for changing or revoking authenticators, mitigating weak passwords and unauthorized changes.

AC-12 Session Termination good match

prevent

Mandates automatic session termination upon organization-defined conditions such as password changes, invalidating stolen JWT tokens and preventing persistent account takeover.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1098 Account Manipulation Persistence

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.

attack.mitre.org →

T1078.003 Local Accounts Stealth

Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

attack.mitre.org →

T1110 Brute Force Credential Access

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.

attack.mitre.org →

Why these techniques?

CVE directly exposes a password-change endpoint (T1190) lacking current-password verification and token invalidation, enabling account takeover via password modification (T1098) and continued use of hijacked local accounts/sessions (T1078.003); missing strength validation also facilitates brute-force (T1110).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Versions prior to 0.17.0-beta1 allow any authenticated user to change their own password without verifying the current password through the /users/{username}/password endpoint. Changing a password…

does not invalidate existing JWT tokens, and there is no validation of password strength. If an attacker obtains a valid session token (e.g., via accidentally exposed JWT, stolen cookie, XSS, compromised device, or sniffing over HTTP), they can change the victim’s password and gain permanent control of the account. Since password changes do not invalidate existing JWT tokens, session hijacks persist even after a password reset. Additionally, the lack of password strength validation exposes accounts to brute-force attacks. This issue has been resolved in version 0.17.0-beta1.

Deeper analysisAI

CVE-2026-33124 is an improper authentication vulnerability (CWE-287) in Frigate, an open-source network video recorder (NVR) with realtime local object detection for IP cameras. Versions prior to 0.17.0-beta1 allow any authenticated user to change their own password without verifying the current password via the /users/{username}/password endpoint. Password changes do not invalidate existing JWT tokens, and the software lacks validation for password strength. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

An attacker with a valid session token—obtained via methods such as accidentally exposed JWTs, stolen cookies, XSS, compromised devices, or sniffing over HTTP—can exploit this to change the victim's password and achieve permanent account takeover. Because password changes fail to invalidate JWT tokens, the attacker's hijacked sessions persist even after the victim resets their password. The lack of password strength validation further enables brute-force attacks against accounts.

The vulnerability is resolved in Frigate version 0.17.0-beta1. Security practitioners should upgrade to this version or later. Additional details are available in the GitHub security advisory at https://github.com/blakeblackshear/frigate/security/advisories/GHSA-24p8-r573-vwr2 and the fixing commit at https://github.com/blakeblackshear/frigate/commit/152e58520614610988bff3b6ff55d0aefd89c1b2.