CVE-2026-95271: dgtlmoon changedetection.io Authentication Hook flask_app.py check_authentication improper authentication
A vulnerability has been found in dgtlmoon changedetection.io up to 0.60.7. The impacted element is the function checkauthentication of the file changedetectionio/flaskapp.py of the component Authentication Hook. Such manipulation leads to improper authentication. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments of dgtlmoon changedetection.io up to version 0.60.7 are identified as affected. The issue is in the Authentication Hook's check_authentication function in changedetectionio/flask_app.py.
What does an attacker need to exploit this issue?
The attack can be performed remotely and does not require privileges or user interaction according to the supplied severity vector. Public exploit disclosure means exploitation may be feasible for unauthenticated attackers.
Is there a vendor-provided fix or workaround?
The provided information does not identify a fixed version or workaround. It states that the vendor was contacted but did not respond.
How can I determine whether my instance may be affected?
Check whether the deployed changedetection.io version is 0.60.7 or earlier, and whether it uses the affected Authentication Hook implementation in changedetectionio/flask_app.py. The supplied data does not provide a specific detection method or indicator of compromise.