changedetection.io CVE-2026-95271

Requires a network-reachable changedetection.io instance (<=0.60.7) that has password authentication enabled - the check_authentication hook must be active for the timing side-channel to be meaningful. Exploitation is unauthenticated but is practically LIMITED by the timing-attack nature: the attacker must send a large volume of requests and perform statistical analysis of response-time discrepancies, and success is significantly degraded by network latency and jitter, making it far harder than the CVSS AC:L implies. Impact is confined to recovering the single application password and gaining access to the monitoring dashboard; no OS-level or scope-crossing compromise.

Signals are modest and internally consistent toward LOW-MODERATE real-world priority. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) implies trivial remote unauthenticated exploitation, but this conflicts with the actual mechanism: the public exploit (herantong/cve) is a TIMING ATTACK (CWE-208 observable timing discrepancy), not a one-shot bypass. Practical remote timing attacks require thousands of statistical requests and are heavily degraded by network jitter, so real-world attack complexity is materially higher than the vendor's AC:L suggests - treat the AC:L as optimistic. Impact is bounded: all three impact metrics are Low (VC:L/VI:L/VA:L), reflecting that success only recovers the single app password and grants access to a self-hosted monitoring dashboard, with no system-level compromise or scope change (SC:N/SI:N/SA:N). SSVC exploitation maturity is Proof-of-Concept (E:P) - a POC exists but there is NO CISA KEV listing and NO EPSS score in the input, so there is no evidence of active or widespread exploitation. The scoring source is VulDB (which tends to rate generously) with no NVD or vendor corroboration, and the vendor did not respond. Net: a genuine but low-severity weakness whose exploitability is likely OVERSTATED by AC:L; prioritize as routine patch-when-available, not emergency.

A remote unauthenticated attacker who can reach an internet-exposed changedetection.io instance with password protection enabled repeatedly submits authentication requests and measures server response times, exploiting the non-constant-time comparison in check_authentication to recover the password character-by-character. A public proof-of-concept documenting the timing-attack methodology exists (herantong/cve, labeled CWE-208), though network latency and jitter make real-world exploitation slow and statistically noisy.