The vulnerability in Grav CMS prior to version 2.0.16 involves the use of a non-constant-time string comparison operator (===) in the Utils::verifyNonce() function for validating CSRF nonces. Because the comparison is not constant-time, an attacker can measure subtle timing differences in responses to iteratively guess the nonce value. This side-channel timing attack weakens the intended security margin of CSRF protection by allowing nonce recovery through multiple requests.

Successful exploitation allows an attacker to recover valid CSRF nonce values by measuring response timing differences. This undermines the CSRF protection mechanism, potentially enabling unauthorized state-changing requests to the application. However, the vulnerability requires high attack complexity and no privileges or user interaction, resulting in a medium severity rating.

No official patch or remediation level is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider monitoring vendor communications for updates and applying any recommended mitigations once published.