The vulnerability exists in getgrav/grav-plugin-login plugin versions prior to 3.9.1, where token comparisons in classes/Controller.php (taskReset()) and login.php (activation handler) use a non-constant-time === string comparison instead of the safer hash_equals() function. This timing discrepancy can leak information about valid tokens. Additionally, the token-submission endpoint lacks rate limiting, theoretically enabling an attacker to send repeated token guesses for a known username to recover a valid token. Despite the high CVSS score (8.7), the vendor assesses the practical exploitability as low and no end-to-end network exploit has been demonstrated.

An attacker could leverage timing differences in token comparison to guess valid password reset or account activation tokens for known usernames. This could potentially allow unauthorized account access or password resets. However, the lack of demonstrated exploitation and the vendor's low exploitability rating suggest the real-world impact is limited.

No official patch or remediation level is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing rate limiting on the token-submission endpoint and monitoring for unusual token guess attempts to reduce risk.