Timing Attack Vulnerability in Grav Plugin for Password Reset Tokens

CVE-2026-72700

What is CVE-2026-72700?

The Grav Plugin Login prior to version 3.9.1 contains a vulnerability that stems from using a non-constant-time string comparison for verifying password reset and account activation tokens. This implementation flaw allows for potential timing attacks, where an attacker could exploit the timing differences during token verification to discern valid tokens by guessing them in rapid succession. Moreover, the absence of rate limiting on the token submission endpoint exacerbates this issue, making it more feasible for attackers to leverage this vulnerability. Although the vendor considers the risk of exploitation to be low and no extensive network attacks have been observed, the vulnerability nonetheless poses a security risk that administrators should address promptly.

References