# CVE-2026-72701: Grav CMS non-constant time nonce comparison in CSRF protection

Source: https://junglewise.ai/threats/cve-2026-72701-grav-cms-non-constant-time-nonce-comparison-in-csrf-protection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-72701 · Severity: low · CVSS 3.7 · Published 2026-08-25

Grav CMS uses a non-constant-time comparison for validating CSRF protection tokens. While the practical difficulty of remote exploitation is high due to nanosecond-scale timing signals, an attacker with the ability to send many requests and measure response timing with precision could potentially recover valid nonce values byte-by-byte rather than guessing them all at once, weakening CSRF protection below its intended security margin.

Technologies: [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-72701 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-72701 being exploited in the wild.

**How severe is CVE-2026-72701?** Low severity, with a CVSS score of 3.7, published 25 August 2026.

**Which products and versions are affected?** getgrav/grav (Packagist) <= 2.0.15, ECOSYSTEM:introduced=0,fixed=2.0.16.

**Is there a fix for CVE-2026-72701?** Yes. getgrav/grav (Packagist): upgrade to 2.0.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-72701 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-72701?** Check whether you run getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- getgrav/grav (Packagist): upgrade to 2.0.16 or later

  ```sh
  composer require getgrav/grav:^2.0.16
  ```


## Technical details

The vulnerability is a timing-based information leak (CWE-208) in the verifyNonce() function within Grav\Common\Utils, which compares CSRF nonces using PHP's === operator instead of the constant-time hash_equals() function. The vulnerable code compares a user-submitted nonce against expected values derived from a secret using simple string equality, which short-circuits on the first differing byte and leaks comparison time. While proof-of-concept testing demonstrates the timing signal exists (approximately 1.23–1.25x timing ratio at the actual 32-byte nonce length), exploiting this over a real network requires substantial statistical averaging across many requests. The function is the core CSRF validation primitive used by Grav core and plugins including the Form and Admin plugins. Patches are available using hash_equals() to replace the vulnerable comparisons.

## Affected products

- Grav Grav CMS 2.0.15 and likely other versions prior to the fix

## Identifiers

- CVE-2026-72701
- GHSA-38p6-h87p-r4cg

## Timeline

- 2026-09-17: disclosed: Vulnerability disclosure via GitHub Advisory GHSA-38p6-h87p-r4cg
- 2026-09-17: other: CVE-2026-72701 assigned (severity: low, CVSS: 3.7 per external report)

## Related threats

- [Grav cross-site scripting in Twig sandbox asset methods](https://junglewise.ai/threats/cve-2026-86197-grav-cross-site-scripting-in-twig-sandbox-asset-methods)
- [Grav Twig sandbox config exfiltration via offsetGet and dump filters](https://junglewise.ai/threats/cve-2026-61842-grav-twig-sandbox-config-exfiltration-via-offsetget-and-dump)
- [Grav ZipArchiver decompression bomb via missing extraction limits](https://junglewise.ai/threats/cve-2026-61690-grav-ziparchiver-decompression-bomb-via-missing-extraction-limits)
- [Grav incomplete Twig sandbox denylist information disclosure](https://junglewise.ai/threats/grav-incomplete-twig-sandbox-denylist-information-disclosure-e903bd3b)
- [Grav UserInterface offsetGet/offsetExists Twig sandbox bypass](https://junglewise.ai/threats/grav-userinterface-offsetget-offsetexists-twig-sandbox-bypass-f709468e)