CVE-2026-54736: Phalcon Encryption Timing Attack Vulnerability

CVE-2026-54736 Overview

CVE-2026-54736 is a timing side-channel vulnerability in the Phalcon PHP framework affecting versions prior to 5.14.1. The Phalcon\Encryption\Crypt::decrypt method compares the attacker-supplied HMAC tag against the freshly computed HMAC using PHP/Zephir identity comparison. This lowers to a byte-wise comparison that returns early on the first differing byte. Attackers can exploit the observable timing discrepancy to recover a valid HMAC tag byte-by-byte. Once recovered, the attacker attaches the forged tag to a chosen initialization vector (IV) and ciphertext, causing decrypt() to accept tampered content as authentic. The issue is fixed in version 5.14.1.

Critical Impact
Successful exploitation breaks authenticated encryption guarantees, allowing attackers to forge encrypted payloads that the application accepts as valid, undermining data integrity.

Affected Products

Phalcon PHP Framework versions prior to 5.14.1
Applications using Phalcon\Encryption\Crypt for authenticated encryption
Any downstream software depending on the vulnerable cphalcon extension

Discovery Timeline

2026-07-10 - CVE-2026-54736 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-54736

Vulnerability Analysis

The vulnerability is a classic timing side-channel weakness [CWE-208] in the HMAC verification step of Phalcon's authenticated decryption routine. When Crypt::decrypt validates the HMAC tag supplied with a ciphertext, it uses PHP identity comparison (===) rather than a constant-time comparator such as hash_equals(). Zephir compiles this identity check into a byte-wise loop that returns as soon as it encounters a differing byte. The runtime therefore leaks information about how many leading bytes of the supplied tag match the correct tag.

An attacker who can submit chosen ciphertexts and measure decryption response time can iterate through possible tag byte values. Each correct byte increases the observed latency by one comparison cycle. Repeating the process across all tag positions reconstructs the full HMAC, enabling forgery of arbitrary ciphertexts that the framework then decrypts as trusted input.

Root Cause

The root cause is the use of non-constant-time comparison for security-critical MAC verification. The pre-patch code path in phalcon/Encryption/Crypt.zep compared HMAC digests using standard equality semantics rather than a length-independent constant-time routine.

Attack Vector

Exploitation requires network access to an endpoint that accepts encrypted input processed by Crypt::decrypt. No authentication or user interaction is needed. The attack complexity is high because it depends on stable timing measurements across many requests, but is feasible against services with predictable latency characteristics.

text

// Patch excerpt from phalcon/Encryption/Crypt.zep
public function decrypt(string input, string key = null) -> string
{
    var blockSize, cipher, cipherText, decrypted, decryptKey, digest,
-       hashAlgorithm, hashLength, iv, ivLength, mode, padded;
+       hashAlgorithm, hashLength, iv, ivLength, mode;

    let decryptKey = this->key;
    if true !== empty(key) {

Source: GitHub Commit ad53ab1

The patch removes the vulnerable padded variable path and replaces the tag comparison with a constant-time routine, ensuring verification time is independent of the tag contents.

Detection Methods for CVE-2026-54736

Indicators of Compromise

High volumes of decryption requests to the same endpoint with incrementally varying HMAC tag bytes
Repeated requests from a single source containing malformed or invalid ciphertext payloads
Application logs showing repeated Crypt::decrypt failures followed by an eventual success from the same client

Detection Strategies

Instrument Crypt::decrypt call sites to log HMAC validation failures and correlate by source IP
Deploy rate limiting and anomaly detection on any endpoint that accepts encrypted tokens or payloads
Inspect deployed Phalcon versions across the estate and flag installations reporting a version earlier than 5.14.1

Monitoring Recommendations

Monitor request-to-response latency distributions for encryption-consuming endpoints and alert on tight-loop probing patterns
Track error rates from cryptographic routines and correlate spikes with authentication or session anomalies
Ingest web server and application logs into a centralized SIEM to enable cross-request timing analysis

How to Mitigate CVE-2026-54736

Immediate Actions Required

Upgrade the cphalcon extension to version 5.14.1 or later on every host running Phalcon
Inventory all applications that call Phalcon\Encryption\Crypt::decrypt and prioritize patching internet-facing services
Rotate encryption keys and any long-lived tokens produced or consumed by the vulnerable Crypt implementation

Patch Information

The fix is available in Phalcon v5.14.1. It replaces the identity comparison in Crypt::decrypt with a constant-time HMAC verification. Full technical context is available in GitHub Issue #17090, Pull Request #17091, and Security Advisory GHSA-8jqh-95g6-7jpj.

Workarounds

Where immediate upgrade is not feasible, wrap Crypt::decrypt calls with an application-level HMAC check that uses PHP's hash_equals() before invoking decryption
Enforce strict rate limits on endpoints that process encrypted input to raise the cost of timing measurement
Restrict access to services consuming encrypted payloads to authenticated network zones until patches are applied

bash

# Verify installed Phalcon version and upgrade via PECL
php -r "echo phpversion('phalcon');"
pecl upgrade phalcon-5.14.1

# Restart PHP-FPM/web server after upgrade
systemctl restart php-fpm
systemctl restart nginx