changedetection.io CVE-2026-95270

Requires that the target changedetection.io instance (<=0.60.7) exposes its password-protected login/UI to the attacker and that the attacker can measure response timing precisely enough to distinguish correct from incorrect password-character prefixes. Practical limiting factors are severe: the CVSS AC:H and vendor's 'difficult' rating reflect that network jitter, TLS/reverse-proxy layers, and interpreter noise force enormous sample counts to extract signal; the app must have password protection enabled (a single shared password/secret) for there to be anything to leak; and only that secret's confidentiality is at risk (no integrity or availability impact). No user interaction and no prior authentication are needed (PR:N/UI:N).

This is a low-real-risk issue despite a moderate 6.3 CVSS 4.0 score. The vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) tells the true story: while network-reachable and requiring no authentication, the attack complexity is high (AC:H) and only confidentiality is marginally impacted (VC:L, with VI/VA:N). The flaw is a classic CWE-208 non-constant-time password comparison in check_password (flask_app.py). Remote timing side-channels are notoriously unreliable in practice - network jitter, TLS/proxy layers, and Python interpreter noise typically swamp the microsecond-level timing signal being measured, requiring huge numbers of averaged samples per guessed character. The vendor itself rates exploitability as 'difficult.' A public PoC exists (herantong/cve on GitHub), so exploitation status is 'publicly available exploit code exists' - but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation. Note the intelligence is single-sourced from VulDB with no independent NVD/vendor advisory, and the vendor was contacted but did not respond, meaning affected-version and fix data are unconfirmed. Bottom line: prioritize normal patch cadence, not emergency response; the theoretical remote-unauth nature is heavily offset by the high complexity and the fact that only a low-severity secret-leak is achievable.

A remote unauthenticated attacker repeatedly submits candidate passwords/shared-secrets to the changedetection.io login and measures server response latency, using statistical averaging over many samples to detect the tiny timing difference between correct and incorrect leading characters, gradually reconstructing the secret. A public proof-of-concept exists demonstrating the timing discrepancy, but the CVSS AC:H rating and the vendor's own 'difficult' assessment reflect how hard reliable extraction is over a real network.