CVE-2026-54736: Phalcon cphalcon timing side-channel in Crypt HMAC verification

CVE-2026-54736 · Severity: high · CVSS 4 · Published 2026-07-10

Phalcon's encryption library uses a non-constant-time comparison when verifying the authentication tag (HMAC) that protects encrypted data. An attacker can exploit timing differences in the comparison to forge authentication tags, allowing them to tamper with encrypted messages the application trusts (such as encrypted authentication cookies) without being detected. This breaks the integrity guarantee of the encryption, potentially leading to unauthorized access or privilege escalation.

Technologies: phalcon/cphalcon (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-54736 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54736 being exploited in the wild.
How severe is CVE-2026-54736?
High severity, with a CVSS score of 4, published 10 July 2026.
Which products and versions are affected?
phalcon/cphalcon (Packagist) <= 5.14.0, ECOSYSTEM:introduced=0,fixed=5.14.1; Phalcon Framework Team Phalcon < 5.14.1.
Is there a fix for CVE-2026-54736?
Yes. phalcon/cphalcon (Packagist): upgrade to 5.14.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54736 attacked?
It is attacked over the network.
Am I affected by CVE-2026-54736?
Check whether you run phalcon/cphalcon (Packagist) or Phalcon Framework Team Phalcon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • phalcon/cphalcon (Packagist): upgrade to 5.14.1 or later
    composer require phalcon/cphalcon:^5.14.1

Technical details

The vulnerability exists in Phalcon\Encryption\Crypt::decrypt() at Zephir source line 246, where the code uses `digest !== hash_hmac(...)` for tag verification. The Zephir compiler lowers this to ZEPHIR_IS_IDENTICAL, which eventually calls a byte-wise memcmp that returns early on the first differing byte—causing verification time to vary based on how many leading bytes of the attacker-supplied tag match the correct value. An attacker can iteratively construct a valid tag by querying the decryption endpoint with modified tags and measuring response times, exploiting this data-dependent timing to recover the tag byte-by-byte (Keyczar/CVE-2009-0654 style attack). Once the tag is forged, the attacker can attach it to a crafted ciphertext; combined with CFB mode malleability, they can inject chosen plaintext into encrypted application state. The fix replaces the non-constant-time comparison with PHP's hash_equals() function, which is already used elsewhere in the framework (CSRF token verification, JWT signature checks) and completes in constant time regardless of where the first differing byte occurs.

Affected products

  • Phalcon cphalcon <= 5.14.0

Identifiers

  • CVE-2026-54736
  • GHSA-8jqh-95g6-7jpj

Timeline

  • 2026-06-16: disclosed: GitHub security advisory GHSA-8jqh-95g6-7jpj published
  • 2026-07-10: advisory: CVE-2026-54736 assigned by NVD
  • 2026-08-28: patched: Patch released in Phalcon 5.14.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.