CVE-2026-72700 Overview
CVE-2026-72700 is a timing side-channel vulnerability [CWE-208] in the getgrav/grav-plugin-login Composer plugin used by the Grav content management system. Versions before 3.9.1 compare password reset and account activation tokens using the non-constant-time === string operator instead of hash_equals(). The affected code paths are taskReset() in classes/Controller.php and the activation handler in login.php. The token-submission endpoint also lacks rate limiting, which theoretically enables an attacker to send repeated guesses against a known username and use response timing differences to recover a valid token.
Critical Impact
An unauthenticated network attacker could attempt to recover valid password reset or activation tokens through timing analysis, potentially leading to account takeover. The vendor rates practical exploitability as low.
Affected Products
- getgrav/grav-plugin-login Composer plugin versions before 3.9.1
- Grav CMS instances that bundle or install the vulnerable login plugin
- Deployments exposing password reset and account activation endpoints to the network
Discovery Timeline
- 2026-08-25 - CVE-2026-72700 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-72700
Vulnerability Analysis
The flaw is a classic timing side-channel weakness in security-sensitive token verification logic. When PHP evaluates $submitted === $expected on two strings, the runtime typically short-circuits at the first differing byte. Attackers observing response latency can infer how many leading bytes of a guess match the stored token. Repeated measurements progressively reveal the token byte by byte.
The vulnerable comparison guards password reset tokens and account activation tokens. A successful recovery lets an attacker reset the password of a known account or activate a pending account without the legitimate email confirmation. Because taskReset does not enforce rate limiting, an attacker faces no application-layer throttle on guess volume.
Root Cause
The root cause is the use of PHP's === operator for cryptographic token comparison in classes/Controller.php (taskReset()) and login.php. Security-sensitive comparisons must run in constant time to prevent leakage of match progress through execution timing. PHP provides hash_equals() for exactly this purpose. The fix in version 3.9.1 replaces the non-constant-time comparison with hash_equals().
Attack Vector
Exploitation requires network access to the Grav login endpoints and knowledge of a valid username. The attacker submits large numbers of reset or activation requests with candidate tokens against the taskReset endpoint. By statistically analyzing server response times across many samples, the attacker attempts to identify tokens that yield longer processing time, indicating a longer matching prefix. See the GitHub Security Advisory and the VulnCheck Advisory on Grav Timing Attack for vendor technical details. No end-to-end network exploit has been publicly demonstrated.
Detection Methods for CVE-2026-72700
Indicators of Compromise
- High-volume POST traffic to Grav password reset or activation endpoints targeting the taskReset handler.
- Repeated reset submissions for the same username with varying token parameters within short time windows.
- Unexpected successful password resets or account activations that do not correlate with legitimate user email interactions.
Detection Strategies
- Alert on repeated requests to taskReset or activation URLs from a single client or upstream IP within short intervals.
- Correlate password reset completions with prior mail-server delivery events to identify resets that lack a corresponding legitimate token issuance.
- Baseline response-time distributions for reset endpoints and flag sustained probing patterns consistent with statistical timing analysis.
Monitoring Recommendations
- Enable verbose web server access logs for Grav admin and login routes, retaining request timing and body length fields.
- Forward Grav application logs and reverse-proxy telemetry into a centralized SIEM for cross-source correlation.
- Monitor authentication and account-state changes for spikes in resets initiated from unusual geographies or user-agent strings.
How to Mitigate CVE-2026-72700
Immediate Actions Required
- Upgrade the getgrav/grav-plugin-login Composer package to version 3.9.1 or later on all Grav installations.
- Audit user accounts for password resets or activations that occurred before patching and reset credentials for any suspicious changes.
- Place Grav login and reset endpoints behind a web application firewall or reverse proxy that enforces request rate limits.
Patch Information
The vendor released a fix in getgrav/grav-plugin-login 3.9.1. The patch replaces the === comparison in taskReset() in classes/Controller.php and in the activation handler in login.php with hash_equals(), eliminating the timing side channel. Refer to the GitHub Security Advisory for the official patch reference.
Workarounds
- Enforce IP-based and per-account rate limiting on reset and activation endpoints at the reverse proxy or WAF layer.
- Restrict access to /user/reset and activation URLs to trusted networks where operationally feasible until the plugin is upgraded.
- Shorten token validity windows and invalidate outstanding reset tokens after the patch is applied.
# Update the Grav login plugin to the patched version via Composer
composer require getgrav/grav-plugin-login:^3.9.1
# Or update via the Grav CLI package manager
bin/gpm update login
# Verify installed plugin version
bin/gpm info login
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
