CVE-2026-95270
dgtlmoon changedetection.io Hash Comparison flask_app.py check_password timing discrepancy
CVSS Score
3.7
EPSS Score
0.0%
EPSS Percentile
0th
A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. The affected element is the function check_password of the file changedetectionio/flask_app.py of the component Hash Comparison. This manipulation of the argument Password causes observable timing discrepancy. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
| CWE | CWE-208 CWE-203 |
| Vendor | dgtlmoon |
| Product | changedetection.io |
| Published | Sep 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for dgtlmoon changedetection.io
Be the first to know when new low vulnerabilities affecting dgtlmoon changedetection.io are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
dgtlmoon / changedetection.io
0.60.0 0.60.1 0.60.2 0.60.3 0.60.4 0.60.5 0.60.6 0.60.7
References
vuldb.com: https://vuldb.com/vuln/408338 vuldb.com: https://vuldb.com/vuln/408338/cti vuldb.com: https://vuldb.com/cve/CVE-2026-95270 vuldb.com: https://vuldb.com/submit/896575 github.com: https://github.com/herantong/cve/blob/main/Timing%20Attack%20Vulnerability%20in%20Password%20Verification%20(CWE-208)
Credits
🔍 herantong (VulDB User) VulDB CNA Team