CVE-2026-95270 - Vulnerability Details

- dgtlmoon changedetection.io Hash Comparison flask_app.py check_password timing discrepancy

Description

A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. The affected element is the function check_password of the file changedetectionio/flask_app.py of the component Hash Comparison. This manipulation of the argument Password causes observable timing discrepancy. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2026-09-22

Score: 6.3 Medium

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the password verification routine of dgtlmoon changedetection.io's Flask application allows an attacker to observe timing variations based on the supplied password. This side channel can reveal incremental password character matches, effectively enabling a remote attacker to reconstruct valid credentials. The weakness is a classic time‑variation side channel, identified as CWE‑208, and also involves improper hash validation that may expose sensitive information as defined in CWE‑203.

Affected Systems

The affected product is dgtlmoon changedetection.io, any deployed instance running version 0.60.7 or earlier. This includes all builds distributed under the open‑source package name changedetection.io, up to the specified version.

Risk and Exploitability

The vulnerability has a CVSS score of 6.3, indicating moderate severity. The exploit is known to exist and is publicly available, though finding a usable exploit requires high technical skill and careful timing measurements. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, suggesting the overall risk from widespread exploitation is moderate, but the potential impact warrants prompt attention. The attack vector is inferred to be remote, over the network, since the flaw exists in a publicly accessible authentication endpoint.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

dgtlmoon

changedetection.io

affected

Version	Status	Constraints
`0.60.0`	affected	—
`0.60.1`	affected	—
`0.60.2`	affected	—
`0.60.3`	affected	—
`0.60.4`	affected	—
`0.60.5`	affected	—
`0.60.6`	affected	—
`0.60.7`	affected	—

No data.

Vendor Product Confidence Versions

Dgtlmoon

Changedetection.io

95%

Version	Status	Scheme	Platform
`0.60.0`	affected	semver	—
`0.60.1`	affected	semver	—
`0.60.2`	affected	semver	—
`0.60.3`	affected	semver	—
`0.60.4`	affected	semver	—
`0.60.5`	affected	semver	—
`0.60.6`	affected	semver	—
`0.60.7`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to a fixed version of changedetection.io (any release newer than 0.60.7).
If an update is not immediately possible, apply a local patch that replaces the timing‑dependent comparison in changedetectionio/flask_app.py with a constant‑time algorithm (e.g., hmac.compare_digest).
Restrict exposure of the authentication endpoint to trusted networks and monitor for repeated authentication failures that may indicate a timing attack is underway.

Generated by OpenCVE AI on September 22, 2026 at 12:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity High

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

No EPSS score available.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/herantong/cve/blob/main/Timing%20Attack%20Vulnerability%20in%20Password%20Verification%20(CWE-208)
https://vuldb.com/cve/CVE-2026-95270
https://vuldb.com/submit/896575
https://vuldb.com/vuln/408338
https://vuldb.com/vuln/408338/cti

History

Tue, 22 Sep 2026 14:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 22 Sep 2026 11:30:00 +0000

Type	Values Removed	Values Added
Description		A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. The affected element is the function check_password of the file changedetectionio/flask_app.py of the component Hash Comparison. This manipulation of the argument Password causes observable timing discrepancy. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title		dgtlmoon changedetection.io Hash Comparison flask_app.py check_password timing discrepancy
First Time appeared		Dgtlmoon Dgtlmoon changedetection.io
Weaknesses		CWE-203 CWE-208
CPEs		cpe:2.3:a:dgtlmoon:changedetection.io::::::::
Vendors & Products		Dgtlmoon Dgtlmoon changedetection.io
References		https://github.com/herantong/cve/blob/main/Timing%20Attack%20Vulnerability%20in%20Password%20Verification%20(CWE-208) https://vuldb.com/cve/CVE-2026-95270 https://vuldb.com/submit/896575 https://vuldb.com/vuln/408338 https://vuldb.com/vuln/408338/cti
Metrics		cvssV2_0 `{'score': 2.6, 'vector': 'AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 3.7, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Dgtlmoon Changedetection.io

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-09-22T11:15:11.677Z

Updated: 2026-09-22T13:03:57.829Z

Reserved: 2026-09-22T05:02:51.234Z

Link: CVE-2026-95270

Vulnrichment

Updated: 2026-09-22T13:03:53.191Z

NVD

Status : Received

Published: 2026-09-22T12:17:14.557

Modified: 2026-09-22T14:17:20.400

Link: CVE-2026-95270

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-22T13:00:14Z

Weaknesses

CWE-203
Observable Discrepancy
CWE-208
Observable Timing Discrepancy

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity High

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object