CVE-2026-95270: dgtlmoon changedetection.io Hash Comparison flask_app.py check_password timing discrepancy
A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. The affected element is the function checkpassword of the file changedetectionio/flaskapp.py of the component Hash Comparison. This manipulation of the argument Password causes observable timing discrepancy. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
dgtlmoon changedetection.io versions up to 0.60.7 are affected, specifically the check_password function in changedetectionio/flask_app.py.
What does an attacker need to exploit this issue?
The attack can be performed remotely without stated privileges or user interaction, but it requires a high degree of complexity. Exploitation relies on manipulating the Password argument and observing timing differences.
Is exploitation theoretical?
No. A published exploit is reported and may be used, although the vulnerability is described as difficult to exploit.
What is known about a vendor fix?
The available information does not identify a fixed version. The vendor was contacted early regarding the disclosure but reportedly did not respond.