Vulnerability · Published Sep 22, 2026 · Assigned by VulDB
CVE-2026-95270dgtlmoon changedetection.io Hash Comparison flask_app.py check_password timing discrepancy
Low 3.7
In plain English
A low-severity security flaw in changedetection.io from dgtlmoon. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Official description
A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. The affected element is the function check_password of the file changedetectionio/flask_app.py of the component Hash Comparison. This manipulation of the argument Password causes observable timing discrepancy. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| dgtlmoon | changedetection.io | 0.60.00.60.10.60.20.60.30.60.40.60.50.60.60.60.7 |
Weakness: CWE-208, CWE-203 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
References
- VDB-408338 | dgtlmoon changedetection.io Hash Comparison flask_app.py check_password timing discrepancy vdb-entry, technical-description
- VDB-408338 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-95270 | CVE Analysis and Report third-party-advisory
- Submit #896575 | dgtlmoon changedetection.io 0.55.8 Race Condition third-party-advisory
- https://github.com/herantong/cve/blob/main/Timing%20Attack%20Vulnerability%20in%20Password%20Verification%20(CWE-208) exploit