This vulnerability exists in the check_password function within changedetectionio/flask_app.py of changedetection.io versions 0.60.0 through 0.60.7. The flaw is an observable timing discrepancy during password hash comparison, which could allow remote attackers to infer password information by measuring response times. The attack complexity is high, and no privileges or user interaction are required. Although an exploit has been published, there is no evidence of active exploitation in the wild. The vendor was contacted but did not respond, and no patch or remediation details are provided.

An attacker can remotely exploit this timing discrepancy to gain information about password hashes, potentially aiding in password recovery or brute force attacks. However, the attack complexity is high, and no direct privilege escalation or denial of service is indicated. The vulnerability has a medium severity with a CVSS score of 6.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official channels for updates. Mitigation may involve applying timing attack resistant password comparison methods once a fix is released.