CVE-2026-72701

Grav CMS before 2.0.16 is affected by a timing side-channel vulnerability in Utils::verifyNonce(). The function uses a non-constant-time string comparison (the === operator) instead of PHP's hash_equals() when validating CSRF nonces . An attacker can measure response-time differences across multi...

EUVD-2026-65215

Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce that uses non-constant-time string comparison with the === operator instead of hashequals for CSRF nonce validation. Attackers can measure response timing differences to recover valid nonce values byte-by-byte through...