CVE-2026-95271 Details
Description
A vulnerability has been found in dgtlmoon changedetection.io up to 0.60.7. The impacted element is the function check_authentication of the file changedetectionio/flask_app.py of the component Authentication Hook. Such manipulation leads to improper authentication. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
An authentication bypass vulnerability has been identified in dgtlmoon changedetection.io versions through 0.60.7. The issue arises in the check_authentication function within changedetectionio/flask_app.py, where a substring matching method is used to exempt login-related endpoints from authentication. This flaw allows endpoints containing the substring 'login' to bypass authentication entirely, creating a security risk by enabling unauthorized access to protected resources. The vulnerability can be exploited remotely, and has been publicly disclosed.
To address this vulnerability, the substring matching in the check_authentication function should be replaced with exact endpoint name matching. Additionally, all exempt endpoints could be consolidated into a single frozenset for better management and auditing.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 22, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/herantong/cve/blob/main/changedetection.io_timing-attack_CWE-208.md | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-95271 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/896578 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/408339 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/408339/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dgtlmoon changedetection.io | <= 0.60.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 22, 2026 | New CVE Received | [email protected] |