CVE-2026-95270: changedetection.io Auth Bypass Vulnerability

CVE-2026-95270 Overview

CVE-2026-95270 is a timing side-channel vulnerability in dgtlmoon changedetection.io versions up to 0.60.7. The flaw exists in the check_password function within changedetectionio/flask_app.py, which performs password hash comparison in a way that leaks timing information. A remote, unauthenticated attacker can measure response time differences to infer characters of the configured password. The issue is classified under CWE-203 (Observable Discrepancy). Exploitation complexity is high due to network jitter, but a public exploit has been disclosed. The vendor did not respond to disclosure attempts.

Critical Impact

Remote unauthenticated attackers can leverage observable timing discrepancies in password verification to progressively recover the application password, leading to unauthorized administrative access to the change detection service.

Affected Products

• dgtlmoon changedetection.io versions up to and including 0.60.7
• Component: Hash Comparison logic in changedetectionio/flask_app.py
• Function: check_password

Discovery Timeline

• 2026-09-22 - CVE-2026-95270 published to the National Vulnerability Database (NVD)
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95270

Vulnerability Analysis

The vulnerability resides in the check_password function of changedetectionio/flask_app.py. The function compares a user-supplied password against the stored value using a non-constant-time comparison. Standard string or hash comparisons in Python return as soon as the first mismatched byte is found. Attackers who can measure response times remotely can therefore infer how many leading bytes of their guess matched the stored credential.

By iteratively submitting candidate passwords and statistically analyzing response latency, an attacker can reconstruct the password one character at a time. Successful recovery grants access to the changedetection.io administrative interface, allowing modification of monitored URLs, notification targets, and integration webhooks. The attack requires many samples and stable network conditions, which is why exploitability is rated difficult.

Root Cause

The root cause is the use of an early-exit comparison routine for security-sensitive hash or password verification instead of a constant-time comparison primitive such as hmac.compare_digest. Any implementation that short-circuits on the first differing byte produces measurable timing variance correlated with the number of matching leading bytes.

Attack Vector

Exploitation is performed remotely over the network against the login endpoint exposed by changedetection.io. The attacker issues repeated authentication requests with crafted password guesses and records precise response times. Statistical aggregation across many samples isolates the timing signal from network noise. Additional analysis is available in the public CVE analysis on GitHub and the VulDB entry for CVE-2026-95270.

// No verified proof-of-concept code is reproduced here.
// See the referenced advisories for technical details on the timing measurement methodology.

Detection Methods for CVE-2026-95270

Indicators of Compromise

• High volumes of failed authentication attempts against the changedetection.io login endpoint originating from a single source or small set of sources.
• Repeated requests with only minor variations in the submitted password field, indicative of character-by-character enumeration.
• Unusually consistent request cadence targeting the login endpoint, suggesting automated timing measurement.

Detection Strategies

• Deploy web application firewall rules that rate-limit and alert on repeated login failures from the same client identity.
• Instrument the authentication path to log request timing and detect distributions consistent with side-channel probing.
• Correlate login failure spikes with subsequent successful administrative logins from the same source to identify possible compromise.

Monitoring Recommendations

• Enable verbose access logging on the changedetection.io reverse proxy and forward logs to a centralized SIEM.
• Monitor for changes to watched URL lists, notification destinations, and API integration settings that follow login anomalies.
• Alert on any administrative session originating from previously unseen IP addresses or geolocations.

How to Mitigate CVE-2026-95270

Immediate Actions Required

• Restrict network exposure of changedetection.io by placing the service behind a VPN, authenticated reverse proxy, or IP allowlist.
• Rotate the current application password to a long, high-entropy value that resists incremental character recovery.
• Enforce strict rate limiting on the authentication endpoint to reduce the number of timing samples an attacker can collect.

Patch Information

At the time of publication, the vendor did not respond to the disclosure and no official patch has been referenced in the advisory. Users should track the dgtlmoon/changedetection.io repository for updates that replace check_password with a constant-time comparison such as hmac.compare_digest. Additional context is available in the VulDB vulnerability record #408338.

Workarounds

• Terminate TLS at a reverse proxy that adds jitter or enforces authentication before requests reach changedetection.io.
• Deploy a fail2ban or equivalent policy that bans source addresses after a small number of failed login attempts.
• Where feasible, patch the deployment locally by replacing the vulnerable comparison in changedetectionio/flask_app.py with a constant-time routine.

# Example NGINX rate limit for the changedetection.io login endpoint
limit_req_zone $binary_remote_addr zone=cdio_login:10m rate=5r/m;

server {
    location /login {
        limit_req zone=cdio_login burst=5 nodelay;
        proxy_pass http://127.0.0.1:5000;
    }
}