Description
Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce() that uses non-constant-time string comparison with the === operator instead of hash_equals() for CSRF nonce validation. Attackers can measure response timing differences to recover valid nonce values byte-by-byte through multiple requests, weakening CSRF protection below its intended security margin.
CVSS 3.7EPSS 0.179%Risk 0.38
View source- Published
- 2026-08-25 02:16:45
- Affected versions
- <2.0.16
- Type
- Web application
- Last modified
- 2026-08-27 17:19:50
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N