CVE-2026-95271
Received Received - Intake

Authentication Bypass in changedetection.io

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: VulDB

Description
A vulnerability has been found in dgtlmoon changedetection.io up to 0.60.7. The impacted element is the function check_authentication of the file changedetectionio/flask_app.py of the component Authentication Hook. Such manipulation leads to improper authentication. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-95271
EUVD
EUVD-2026-84363

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
dgtlmoon changedetection.io 0.60.7
dgtlmoon changedetection.io to 0.55.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-95271 is an authentication bypass vulnerability in changedetection.io versions up to 0.60.7. The flaw is in the check_authentication function in flask_app.py, which incorrectly allows access to any endpoint containing the substring 'login' without proper authentication. This is due to a flawed substring check that exempts such endpoints from authentication requirements.

Detection Guidance

Check for endpoints containing 'login' in their names that do not require authentication. Inspect flask_app.py for the check_authentication function and verify if substring matching is used instead of exact endpoint matching. Review plugin-registered routes for names containing 'login'.

Impact Analysis

This vulnerability allows attackers to bypass authentication and access sensitive endpoints by sending requests to endpoints with 'login' in their name. This could lead to unauthorized access to data or functionality, potentially exposing sensitive information or allowing malicious actions to be performed without proper credentials.

Compliance Impact

This vulnerability allows unauthorized access to endpoints with 'login' in their names, bypassing authentication. This could lead to unauthorized data access or modification, violating GDPR's data protection requirements and HIPAA's access control mandates for sensitive health information.

Mitigation Strategies

Update changedetection.io to a patched version if available. Modify flask_app.py to replace substring matching with exact endpoint matching in check_authentication. Audit plugin routes to ensure none contain 'login' in their names. Consider adding middleware or API gateways to enforce authentication globally.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95271. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart