CVE-2026-95270 in changedetection.io
Summary
by MITRE • 09/22/2026
A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. The affected element is the function check_password of the file changedetectionio/flask_app.py of the component Hash Comparison. This manipulation of the argument Password causes observable timing discrepancy. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in dgtlmoon changedetection.io versions up to 0.60.7 represents a classic timing side-channel attack vector within the application's authentication mechanism. Specifically, the flaw resides in the check_password function located in the flask_app.py file of the Hash Comparison component. This issue arises from an improper implementation of password verification logic that fails to execute with constant time complexity. In secure cryptographic implementations, comparison operations must take a uniform amount of time regardless of where the mismatch occurs between the input and the stored hash. However, in this instance, the application likely utilizes a standard string or byte-by-byte comparison method which terminates early upon detecting the first differing character. This behavior introduces an observable timing discrepancy that can be measured by an attacker to deduce information about the correct password characters one at a time.
From a technical perspective, this vulnerability aligns with CWE-208, Observable Timing Discrepancy, and is closely related to CWE-357, Insufficiently Random Values, when considering the broader context of authentication security. The core issue is that the timing difference allows an external observer to infer whether specific characters in a guessed password match those in the stored hash. By sending multiple requests with varying passwords and measuring the response time for each, an attacker can statistically determine which guesses result in longer processing times, thereby narrowing down the correct credential set. This type of attack is particularly dangerous because it does not require breaking encryption algorithms directly but rather exploits implementation flaws in how data is processed during verification.
The operational impact of this vulnerability is significant as it enables remote authentication bypass through brute-force techniques that are far more efficient than traditional methods. Although the exploitability is described as difficult and requires a high degree of complexity, the fact that an exploit has been published lowers the barrier to entry for malicious actors. An attacker with network access to the changedetection.io instance can leverage this timing leak to systematically reconstruct valid user passwords without triggering typical rate-limiting or lockout mechanisms associated with standard brute-force attacks. This compromises the confidentiality and integrity of user accounts, potentially leading to unauthorized access to monitored web pages and sensitive data managed by the application.
The attack vector is classified as remote (CVSS Vector: Network), meaning it can be exploited over a network such as the Internet without requiring local access or prior authentication. The complexity factor being high reflects the need for precise timing measurements, which may require specialized tools or scripts to automate and analyze latency differences accurately across multiple requests. Despite these challenges, the availability of published exploits means that automated scanning tools could potentially detect and leverage this weakness in vulnerable deployments. The vendor's lack of response to early disclosure attempts further exacerbates the risk by delaying potential patches or mitigations for users who rely on this open-source monitoring tool.
To mitigate this vulnerability, immediate remediation should focus on upgrading to a patched version of changedetection.io where the check_password function has been corrected to use constant-time comparison algorithms such as hmac.compare_digest in Python environments. For organizations unable to upgrade immediately due to dependency constraints or other operational reasons, compensating controls are essential. Implementing strict rate limiting and account lockout policies can help mitigate brute-force attempts, although they may not fully prevent timing-based attacks if the thresholds are too permissive. Additionally, deploying a Web Application Firewall with rules designed to detect anomalous request patterns or excessive authentication failures can provide an additional layer of defense. Monitoring for unusual spikes in response times during login attempts could also serve as an early warning system for ongoing exploitation efforts.
Security practitioners should treat this vulnerability with high priority given the nature of timing attacks and their effectiveness against poorly implemented hash comparisons. Regular security assessments, including static code analysis focused on cryptographic implementations, can help identify similar flaws before they are exploited in production environments. Adhering to industry standards such as OWASP Top 10 guidelines regarding authentication best practices is crucial for preventing such issues. Developers must ensure that all sensitive data comparisons, especially those involving passwords or tokens, utilize constant-time functions provided by trusted cryptographic libraries rather than standard equality operators. This ensures that execution time remains independent of the input values, thereby eliminating the side-channel information leak entirely.