PT-2026-57320 · Phalcon · Cphalcon

Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-54736

Mitre

CVSS v4.0

8.2

High

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Phalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, PhalconEncryptionCrypt::decrypt compares the attacker-supplied HMAC tag against the freshly computed HMAC using PHP/Zephir identity comparison, which lowers to a byte-wise comparison that returns early on the first differing byte. This observable timing discrepancy can allow an attacker to recover a valid tag byte-by-byte and attach it to a chosen IV and ciphertext so that decrypt() accepts tampered encrypted content as authentic. This issue is fixed in version 5.14.1.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-208

CWE-347

Related Identifiers

CVE-2026-54736

Affected Products

Cphalcon

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-54736 · Security Note
• https://github.com/phalcon/cphalcon/security/advisories/GHSA-8jqh-95g6-7jpj · Note
• https://github.com/phalcon/cphalcon/commit/ad53ab1b2e7ec59b3af92b0b37b8aaa099011137 · Note
• https://github.com/phalcon/cphalcon/issues/17090 · Note
• https://github.com/phalcon/cphalcon/releases/tag/v5.14.1 · Note
• https://github.com/phalcon/cphalcon/pull/17091 · Note