PT-2026-57320 · Phalcon · Cphalcon

Publicado 2026-07-10 · Atualizado 2026-07-10 · CVE-2026-54736

Mitre

CVSS v4.0

8.2

Alta

Vetor base

AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Phalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, PhalconEncryptionCrypt::decrypt compares the attacker-supplied HMAC tag against the freshly computed HMAC using PHP/Zephir identity comparison, which lowers to a byte-wise comparison that returns early on the first differing byte. This observable timing discrepancy can allow an attacker to recover a valid tag byte-by-byte and attach it to a chosen IV and ciphertext so that decrypt() accepts tampered encrypted content as authentic. This issue is fixed in version 5.14.1.

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-208

CWE-347

Identificadores relacionados

CVE-2026-54736

Produtos afetados

Cphalcon

Referências · 6

• https://github.com/phalcon/cphalcon/security/advisories/GHSA-8jqh-95g6-7jpj · Nota
• https://github.com/phalcon/cphalcon/commit/ad53ab1b2e7ec59b3af92b0b37b8aaa099011137 · Nota
• https://github.com/phalcon/cphalcon/issues/17090 · Nota
• https://github.com/phalcon/cphalcon/releases/tag/v5.14.1 · Nota
• https://github.com/phalcon/cphalcon/pull/17091 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-54736 · Nota de Segurança