CVE-2026-33124: Password Reset Vulnerability in Frigate

An attacker exploiting CVE-2026-33124 can gain complete control of a Frigate user account. This is achieved by leveraging a valid session token—obtained through accidental JWT exposure, cookie theft, XSS attacks, compromised devices, or insecure HTTP connections—to change the victim's password. Critically, the password change does not invalidate existing JWT tokens, meaning the attacker retains persistent access even after the password is altered. This allows for unauthorized access to the NVR's video streams, configuration settings, and potentially other connected devices within the network. The blast radius extends to any data accessible through the Frigate interface, including live and recorded video footage, user accounts, and system configurations.

1. Reserved2026-03-17
2. Published2026-03-20
3. EPSS updated2026-03-27

The primary mitigation for CVE-2026-33124 is to immediately upgrade Frigate to version 0.17.0-beta1 or later. If upgrading is not immediately feasible, consider implementing stricter JWT token management practices. Revoke existing JWT tokens after password changes, even if it requires a service restart. Additionally, enforce strong password policies within Frigate to reduce the likelihood of brute-force attacks. Review network configurations to ensure secure communication channels (HTTPS) are used to prevent token sniffing. After upgrading, confirm the fix by attempting a password change with an existing JWT token; the change should fail and the token should be invalidated.