CVE-2026-54736: Timing Side-Channel Vulnerability in Phalcon Crypt Decryption
Vulnerability ID: CVE-2026-54736
CVSS Score: 8.2
Published: 2026-08-28
Phalcon versions prior to 5.14.1 are vulnerable to a timing side-channel attack in the authenticated decryption process. The HMAC signature verification utilizes a non-constant-time byte comparison, allowing unauthenticated remote attackers to reconstruct valid signatures and forge arbitrary encrypted payloads.
TL;DR
A timing side-channel in Phalcon allows remote, unauthenticated attackers to forge encrypted payloads by guessing HMAC signatures byte-by-byte.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-208
- Attack Vector: Network
- CVSS v4.0: 8.2 (High)
- Exploit Status: Proof-of-Concept
- KEV Status: Not Listed
Affected Systems
- Phalcon PHP Framework applications using Crypt::decrypt() with signing enabled
-
cphalcon: < 5.14.1 (Fixed in:
5.14.1)
Code Analysis
Commit: ad53ab1
Fix constant-time verification for HMAC signature and reorder unpadding execution flow
Exploit Details
- GitHub Issue: Vulnerability report and discussion of the timing side-channel.
Mitigation Strategies
- Upgrade Phalcon to version 5.14.1 or higher
- Implement rate-limiting on decryption endpoints to prevent brute-force timing attacks
- Ensure error messages do not leak decryption or signature validation states
Remediation Steps:
- Verify current extension version via 'php -ri phalcon'
- Update phalcon/cphalcon dependency in composer.json to '^5.14.1'
- Recompile/update the C extension in the target environment
- Restart the PHP-FPM or Apache web server to apply the changes
References
Read the full report for CVE-2026-54736 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)