Phalcon's Crypt::decrypt method in versions before 5.14.1 performs HMAC tag verification using a PHP/Zephir identity comparison that reduces to a byte-wise comparison returning early upon the first byte difference. This creates an observable timing discrepancy (CWE-208) that can be exploited to recover a valid HMAC tag byte-by-byte. An attacker can then attach this valid tag to a chosen initialization vector (IV) and ciphertext, causing decrypt() to accept tampered encrypted content as authentic. This vulnerability is addressed in Phalcon version 5.14.1.

An attacker can exploit the timing discrepancy to recover a valid HMAC tag incrementally, enabling them to forge encrypted content that decrypt() will accept as authentic. This compromises the integrity of encrypted data, potentially allowing unauthorized data manipulation without detection.

Upgrade Phalcon cphalcon to version 5.14.1 or later, where this timing discrepancy vulnerability is fixed. No other mitigation is indicated by the vendor advisory.