CVE-2026-72700: Timing Vulnerability in Grav Login Plugin

The getgrav/grav-plugin-login Composer plugin, versions prior to 3.9.1, contains a vulnerability that allows for potential account takeover via timing analysis. The issue resides in the classes/Controller.php and login.php files, where password reset and account activation tokens are validated using a non-constant-time '===' operator instead of the secure hash_equals() function. This allows an attacker to measure the time taken for the server to process token verification requests. Combined with the absence of rate limiting on the 'taskReset' endpoint, an attacker can theoretically brute-force valid tokens by analyzing response time variations. While no end-to-end network exploit has been observed, the design flaw represents a significant risk for administrative account compromise within impacted Grav deployments.

Impact

Successful exploitation could lead to unauthorized account activation or password resets, potentially resulting in full administrative compromise of the affected Grav instance. This impacts all deployments utilizing the vulnerable plugin versions, particularly those exposed to the public internet where brute-force attempts can be performed systematically.

Recommendation

• Upgrade the Grav login plugin to version 3.9.1 or later to remediate CVE-2026-72700.
• Implement request rate limiting at the WAF or reverse proxy level for all 'taskReset' and account activation endpoints to mitigate potential brute-force attempts.
• Audit web server access logs for anomalous spikes in traffic targeting password reset endpoints, which may indicate automated token-guessing attempts.