HMAC Timing Discrepancy in Phalcon PHP Framework Affects Encryption Accuracy

CVE-2026-54736

What is CVE-2026-54736?

A vulnerability exists in the Phalcon PHP framework where the decryption process does not adequately validate the HMAC tag due to timing discrepancies. The implementation compares the provided HMAC tag against a freshly computed one using a method that allows early exit on the first differing byte. This can be exploited by an attacker to recover valid tag bytes gradually, enabling them to create legitimate-looking encrypted content with a chosen initialization vector (IV), ultimately bypassing security measures and allowing tampered data to be treated as authentic.

References