{"uuid": "b0d01bc4-2fa5-4b2d-80bc-1f9e421274d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54736", "type": "seen", "source": "https://gist.github.com/alon710/c1d8520d53bfcef788cd28dc6c9eb99d", "content": "# CVE-2026-54736: CVE-2026-54736: Timing Side-Channel Vulnerability in Phalcon Crypt Decryption\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54736\n\n## Summary\nPhalcon versions prior to 5.14.1 are vulnerable to a timing side-channel attack in the authenticated decryption process. The HMAC signature verification utilizes a non-constant-time byte comparison, allowing unauthenticated remote attackers to reconstruct valid signatures and forge arbitrary encrypted payloads.\n\n## TL;DR\nA timing side-channel in Phalcon allows remote, unauthenticated attackers to forge encrypted payloads by guessing HMAC signatures byte-by-byte.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-208\n- **Attack Vector**: Network\n- **CVSS v4.0**: 8.2 (High)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Phalcon PHP Framework applications using Crypt::decrypt() with signing enabled\n- **cphalcon**: < 5.14.1 (Fixed in: `5.14.1`)\n\n## Mitigation\n\n- Upgrade Phalcon to version 5.14.1 or higher\n- Implement rate-limiting on decryption endpoints to prevent brute-force timing attacks\n- Ensure error messages do not leak decryption or signature validation states\n\n**Remediation Steps:**\n1. Verify current extension version via 'php -ri phalcon'\n2. Update phalcon/cphalcon dependency in composer.json to '^5.14.1'\n3. Recompile/update the C extension in the target environment\n4. Restart the PHP-FPM or Apache web server to apply the changes\n\n## References\n\n- [GitHub Security Advisory GHSA-8jqh-95g6-7jpj](https://github.com/phalcon/cphalcon/security/advisories/GHSA-8jqh-95g6-7jpj)\n- [Phalcon Issue #17090](https://github.com/phalcon/cphalcon/issues/17090)\n- [Phalcon PR #17091](https://github.com/phalcon/cphalcon/pull/17091)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54736) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-28T16:32:37.947723Z"}