{"apiVersion":"1.0","identifier":"CVE-2026-72700","description":"The getgrav/grav-plugin-login Composer plugin before 3.9.1 (used by Grav) compares password reset and account activation tokens using a non-constant-time === string comparison instead of hash_equals() in classes/Controller.php (taskReset()) and login.php (activation handler). Because the token-submission endpoint (taskReset) also lacks rate limiting, an attacker could in principle send repeated token guesses against a known username and use the timing differences to attempt to recover a valid token, though the vendor rates the practical exploitability as low and no end-to-end network exploit has been demonstrated.","publishedAt":"2026-08-25T02:16:45","lastModifiedAt":"2026-08-25T18:18:02","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72700","cvssScore":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","epssProbability":0.00255,"riskScore":0.77,"affectedProduct":"grav-plugin-login","affectedVersions":"<3.9.1","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72700","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72700","en":"https://www.redsauce.net/en/cves/CVE-2026-72700","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72700","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72700","de":"https://www.redsauce.net/de/cves/CVE-2026-72700","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72700","el":"https://www.redsauce.net/el/cves/CVE-2026-72700"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72700"}}