CVE-2026-33124: 
NixOS vulnerability analysis and mitigation

CVE-2026-33124 is an improper authentication vulnerability in Frigate, an open-source network video recorder (NVR) with real-time local object detection for IP cameras. The flaw exists in the /users/{username}/password endpoint, which allows any authenticated user to change their own password without verifying the current password, does not invalidate existing JWT tokens upon password change, and lacks password strength validation. It affects Frigate versions up to and including 0.16.3, and was published on March 20, 2026, with a fix released in version 0.17.0-beta1. The CVSS v3.1 base score is 8.8 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-287 (Improper Authentication): the /users/{username}/password API endpoint accepted a new password without requiring the user to supply their current password, meaning any valid session token was sufficient to overwrite account credentials. Compounding this, the application did not record a password_changed_at timestamp or embed an iat (issued-at) claim in JWTs, so existing tokens remained valid indefinitely after a password change — allowing an attacker who obtained a session token to maintain persistent access even if the victim later attempted a password reset. Additionally, no server-side password strength policy was enforced, leaving accounts vulnerable to brute-force attacks. The patch (commit 152e585) adds old_password verification for self-service changes, introduces a password_changed_at database field and JWT iat claim to invalidate stale tokens on refresh, and enforces minimum password complexity rules (GitHub Commit, GitHub Advisory).

An attacker who obtains a valid session token — through an accidentally exposed JWT, stolen cookie, XSS, compromised device, or HTTP sniffing — can silently change the victim's account password and gain permanent control. Because password changes did not invalidate existing JWTs, the attacker's session persists even after the legitimate user attempts a password reset, making account recovery difficult without administrative intervention. For a home security or surveillance deployment, this could result in unauthorized access to live and recorded camera feeds, configuration changes, and potential exposure of physical security posture (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.038%, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid authenticated session token, which limits the attack surface but is achievable through several realistic token-theft vectors (Feedly, GitHub Advisory).

1. Obtain a valid session token: Acquire a victim's JWT or session cookie via one of several methods — intercepting unencrypted HTTP traffic to the Frigate instance, exploiting an XSS vulnerability to steal the cookie, accessing a device where the session is stored, or finding an accidentally exposed JWT.
2. Authenticate with the stolen token: Use the stolen JWT or cookie to make authenticated API requests to the Frigate instance on behalf of the victim.
3. Send password change request: Issue a PUT request to /users/{username}/password with only the new desired password in the request body (no old_password field required in vulnerable versions):

   PUT /api/users/<victim_username>/password
   Cookie: frigate_token=<stolen_jwt>
   Content-Type: application/json
   
   {"password": "attacker_chosen_password"}

4. Maintain persistent access: Because the password change does not invalidate the original JWT, the attacker's stolen token continues to work until it naturally expires, while the victim is locked out of their own account.
5. Access camera feeds and configuration: Use the now-controlled account to view live and recorded video streams, modify detection settings, or further enumerate the network environment (GitHub Advisory, GitHub Commit).

• Network: Unexpected PUT requests to /api/users/{username}/password originating from unfamiliar IP addresses or at unusual times; Frigate API traffic over HTTP (unencrypted) that could expose JWT tokens to interception.
• Logs: Frigate access logs showing successful PUT /users/{username}/password requests without a preceding login event from the same session; repeated failed login attempts followed by a successful password change (brute-force pattern).
• Authentication Events: User accounts with recently changed passwords where the legitimate user did not initiate the change; active JWT sessions that predate a password change event (indicating stale token reuse).
• Behavioral: Unexpected access to camera streams or configuration changes from sessions that should have been invalidated after a password reset.

Upgrade Frigate to version 0.17.0-beta1 or later, which resolves all three issues: it requires old_password verification for self-service password changes, adds a password_changed_at timestamp and JWT iat claim to invalidate stale tokens on refresh, and enforces a minimum password complexity policy (8+ characters, uppercase, digit, and special character). For systems that cannot be patched immediately: restrict network access to the Frigate web interface using firewall rules or network segmentation; enforce HTTPS-only access to prevent JWT theft via sniffing; monitor logs for unexpected password change API calls; and rotate the JWT secret to force all active sessions to re-authenticate (GitHub Advisory, GitHub Commit).

The vulnerability was reported by researcher czerlun and published as a GitHub Security Advisory by the Frigate maintainer (blakeblackshear) on January 10, 2026. A Bluesky post from a CVE tracking account noted the disclosure. Community discussion has been limited, consistent with the relatively niche deployment base of self-hosted NVR software (GitHub Advisory).