CVE-2026-95271

HIGH 7.3

dgtlmoon changedetection.io Authentication Hook flask_app.py check_authentication improper authentication

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability has been found in dgtlmoon changedetection.io up to 0.60.7. The impacted element is the function check_authentication of the file changedetectionio/flask_app.py of the component Authentication Hook. Such manipulation leads to improper authentication. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-287
Vendor	dgtlmoon
Product	changedetection.io
Published	Sep 22, 2026
Last Updated	Sep 22, 2026

Stay Ahead of the Next One

Get instant alerts for dgtlmoon changedetection.io

Be the first to know when new high vulnerabilities affecting dgtlmoon changedetection.io are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

dgtlmoon / changedetection.io

0.60.0 0.60.1 0.60.2 0.60.3 0.60.4 0.60.5 0.60.6 0.60.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/408339 vuldb.com: https://vuldb.com/vuln/408339/cti vuldb.com: https://vuldb.com/cve/CVE-2026-95271 vuldb.com: https://vuldb.com/submit/896578 github.com: https://github.com/herantong/cve/blob/main/changedetection.io_timing-attack_CWE-208.md

Credits

🔍 herantong (VulDB User) VulDB CNA Team