CVE-2026-95270 Details

A timing attack vulnerability has been identified in changedetection.io versions through 0.60.7. The issue arises in the password verification function within the Flask application, specifically in the file 'changedetectionio/flask_app.py'. The vulnerability allows remote attackers to exploit timing discrepancies in password hash comparisons, potentially leading to authentication bypass. The vulnerable code compares PBKDF2-derived keys to stored hashes using a standard equality operator, which short-circuits on the first byte mismatch. This behavior can be exploited by measuring response times to infer correct password hash bytes, requiring a high level of skill and effort.

To address this vulnerability, replace the standard equality comparison with a constant-time comparison function, such as 'hmac.compare_digest' or 'secrets.compare_digest'. Additionally, consider implementing rate limiting or account lockout measures on the '/login' endpoint to further mitigate the risk of timing attacks.