LOWVulnerability
CVE-2026-72701
Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce() that uses non-constant-time string comparison with the === operator instead of hash_equals() for CSRF nonce validation. Attackers can measure response timing differences to recover valid nonce values byte-by-byte through multiple requests, weakening CSRF protection below its intended security margin.
Properties
- severity
- LOW
- score
- 3.7
- cve_id
- CVE-2026-72701
- vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- published_at
- 2026-08-25T02:16:45.980
- last_modified
- 2026-08-31T20:52:56.343
Related Entities (2)
HAS_WEAKNESS (1)
→[Weakness]Observable Timing Discrepancy
DESCRIBED_BY (1)
→[Source]NVD
Explore deeper with Ninja Signal's threat intelligence graph