CVE-2026-72700: Observable Timing Discrepancy in getgrav grav

The getgrav/grav-plugin-login plugin versions prior to 3.9.1 use a non-constant-time === string comparison for validating password reset and account activation tokens in classes/Controller.php (taskReset()) and login.php (activation handler). This timing discrepancy could allow an attacker to perform repeated token guesses against a known username and potentially recover a valid token by analyzing timing differences. Additionally, the token submission endpoint lacks rate limiting, which could facilitate such attempts. Despite these factors, the vendor assesses the practical exploitability as low, and no end-to-end network exploit has been reported.

An attacker could theoretically use timing differences in token validation to guess valid password reset or account activation tokens for a known username. This could lead to unauthorized account access or password resets if successfully exploited. However, the vendor considers the practical risk low, and no active exploitation has been observed.

No official fix or patch has been confirmed as of the provided data. Users should monitor vendor advisories for updates. Implementing rate limiting on the token submission endpoint and using constant-time comparison functions like hash_equals() for token validation are recommended best practices to mitigate this issue.