CVE-2026-72700 Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparison

The getgrav/grav-plugin-login Composer plugin before 3.9.1 used by Grav compares password reset and account activation tokens using a non-constant-time === string comparison instead of hashequals in classes/Controller.php taskReset and login.php activation handler. Because the token-submission...