CVE-2026-72700
Received Received - Intake

Timing Attack in Grav Login Plugin

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
The getgrav/grav-plugin-login Composer plugin before 3.9.1 (used by Grav) compares password reset and account activation tokens using a non-constant-time === string comparison instead of hash_equals() in classes/Controller.php (taskReset()) and login.php (activation handler). Because the token-submission endpoint (taskReset) also lacks rate limiting, an attacker could in principle send repeated token guesses against a known username and use the timing differences to attempt to recover a valid token, though the vendor rates the practical exploitability as low and no end-to-end network exploit has been demonstrated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-72700
EUVD
EUVD-2026-65214

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav-plugin-login to 3.9.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-208 Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Grav CMS plugin getgrav/grav-plugin-login versions 3.9.0 and below. It involves two issues: password reset and account activation tokens are compared using a non-constant-time string comparison (===) instead of the secure hash_equals() function, which could allow timing attacks to recover tokens. Additionally, the password reset submission endpoint lacks rate limiting, enabling repeated token guesses to statistically extract timing differences.

Detection Guidance

To detect this vulnerability, check if your Grav CMS installation uses the getgrav/grav-plugin-login plugin version 3.9.0 or below. Inspect the plugin files, particularly classes/Controller.php and login.php, for non-constant-time token comparisons using === instead of hash_equals().

Commands to check plugin version: grep -r 'getgrav/grav-plugin-login' /path/to/grav/vendor/composer/installed.json. Look for version <= 3.9.0.

Impact Analysis

An attacker could exploit this to reset a known user's password or activate an account they don't control by recovering tokens through timing differences. The lack of rate limiting allows repeated guesses, increasing the chance of success. However, the vendor rates exploitability as low and no real-world attacks have been confirmed.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing user account tokens through timing attacks. Non-constant-time token comparisons and lack of rate limiting may allow unauthorized password resets or account activations, violating data integrity and access control requirements under these regulations.

Mitigation Strategies

Immediately update the getgrav/grav-plugin-login plugin to version 3.9.1 or higher. Replace all non-constant-time token comparisons (===) with hash_equals() in Controller.php and login.php. Ensure the password reset endpoint has rate limiting enabled.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72700. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart