Description

A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. The affected element is the function check_password of the file changedetectionio/flask_app.py of the component Hash Comparison. This manipulation of the argument Password causes observable timing discrepancy. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-22T12:17:14.557Z",
  "pubdate": "2026-09-22T12:17:14.557Z",
  "executiveSummary": "A timing side-channel vulnerability exists within the authentication mechanism of dgtlmoon changedetection.io versions up to 0.60.7. The vulnerability originates from a non-constant time comparison implementation during password validation.\nThis flaw allows a remote attacker to infer valid password information by measuring the time taken for the server to respond to authentication requests. By analyzing the observable timing discrepancies across numerous attempts, an adversary may iteratively determine the correct password character by character.\nThe vulnerability resides in the check_password function within the changedetectionio/flask_app.py file. While exploitation is described as complex and difficult, the existence of public exploit code increases the risk of successful unauthorized access.\nThe vendor remains unresponsive to disclosure attempts, leaving current installations vulnerable. Organizations utilizing affected versions are at risk of credential compromise if the application is exposed to untrusted networks.\nSuccessful exploitation requires the capability to perform repetitive, high-precision network requests to the target service to measure response latency accurately.",
  "technicalDetails": "The root cause of the vulnerability is the use of a standard string comparison operation within the check_password function in changedetectionio/flask_app.py. In many programming environments, standard string comparison operators (such as '==' in Python) return false immediately upon encountering the first non-matching character.\nThis behavior creates a deterministic correlation between the duration of the comparison execution and the number of matching leading characters provided in the attacker's input. When the input password matches the actual password up to index 'i', the comparison process proceeds to index 'i+1'. This incremental processing adds a measurable amount of CPU time to the response for each correctly guessed character.\nThe attack flow involves an adversary sending a series of crafted authentication requests to the remote instance. By measuring the round-trip time (RTT) of the HTTP response with high-resolution timers, the attacker can differentiate between a request that failed early and one that failed slightly later, indicating a successful partial match.\nDue to the 'difficult' exploitability rating, this attack likely requires a significant volume of requests to overcome network jitter and latency fluctuations. Statistical analysis techniques, such as averaging multiple measurements for the same input character, are typically employed by attackers to filter out noise and isolate the timing signal introduced by the vulnerable comparison function.\nThe component affected is the Hash Comparison logic. Because the vulnerability allows for the iterative recovery of valid credentials, the post-exploitation impact is a complete bypass of the authentication gate. Once a valid password is recovered, the attacker gains the same level of access as an authenticated user, which in the context of changedetection.io, may include access to sensitive tracked data, configuration settings, or system operational controls.\nAs the issue remains unpatched by the vendor, the application logic continues to leak information through the side channel. The attack is fully remote, requiring no specific privileges or pre-existing authentication to initiate the probing process against the authentication endpoint."
}