CVE-2026-95270: dgtlmoon changedetection.io Hash Comparison flask_app.py check_password timing discrepancy

Vulnerability summary

CVE-2026-95270 is a medium (CVSS 6.3) Observable Discrepancy vulnerability in dgtlmoon changedetection.io. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 22-09-2026
   PublishedVulnerability first disclosed.
2. 22-09-2026
   Last modifiedVulnerability information updated.

Description

A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. The affected element is the function check_password of the file changedetectionio/flask_app.py of the component Hash Comparison. This manipulation of the argument Password causes observable timing discrepancy. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
• CWE-208Observable Timing DiscrepancyTwo separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.