फ्रिगेट में असुरक्षित पासवर्ड बदलने की कार्यक्षमता है

An attacker exploiting CVE-2026-33124 can gain complete control of a Frigate user account. This is achieved by leveraging a valid session token—obtained through accidental JWT exposure, cookie theft, XSS attacks, compromised devices, or insecure HTTP connections—to change the victim's password. Critically, the password change does not invalidate existing JWT tokens, meaning the attacker retains persistent access even after the password is altered. This allows for unauthorized access to the NVR's video streams, configuration settings, and potentially other connected devices within the network. The blast radius extends to any data accessible through the Frigate interface, including live and recorded video footage, user accounts, and system configurations.

Organizations and individuals using Frigate for network video recording, particularly those with deployments using HTTP instead of HTTPS, are at risk. Shared hosting environments where multiple users share a single Frigate instance are also particularly vulnerable, as a compromise of one user account could lead to the compromise of others.

• python / server:

# Check for Frigate versions prior to 0.17.0-beta1
ps aux | grep -i frigate | grep -i '0.17.0-beta1'

• generic web:

# Check for exposed JWT tokens in browser history or network traffic using browser developer tools or network analysis tools.

1. 2026-03-20Disclosure

   disclosure

1. आरक्षित2026-03-17
2. प्रकाशित2026-03-20
3. EPSS अद्यतन2026-03-27

The primary mitigation for CVE-2026-33124 is to immediately upgrade Frigate to version 0.17.0-beta1 or later. If upgrading is not immediately feasible, consider implementing stricter JWT token management practices. Revoke existing JWT tokens after password changes, even if it requires a service restart. Additionally, enforce strong password policies within Frigate to reduce the likelihood of brute-force attacks. Review network configurations to ensure secure communication channels (HTTPS) are used to prevent token sniffing. After upgrading, confirm the fix by attempting a password change with an existing JWT token; the change should fail and the token should be invalidated.