CVE-2026-54736 Details

A vulnerability exists in the Phalcon PHP framework's encryption component, specifically in the Crypt::decrypt method, prior to version 5.14.1. The issue arises because HMAC verification is performed using a non-constant-time comparison, which creates a timing side-channel. This allows an attacker to recover a valid HMAC tag byte-by-byte and attach it to a chosen initialization vector (IV) and ciphertext, deceiving the decryption process into accepting tampered data as authentic. The vulnerability exploits the fact that the comparison operation returns early upon encountering the first differing byte, creating an opportunity for a timing attack. This flaw is particularly concerning because it undermines the integrity of the encrypted data, such as cookies containing authorization information.

Users can upgrade to Phalcon version 5.14.1 or later, where this vulnerability has been fixed. Instructions for updating can be found in the Phalcon documentation.