{"id":"CVE-2026-54736","title":"Phalcon is a high-performance, full-stack PHP framework","summary":"Phalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, Phalcon\\Encryption\\Crypt::decrypt compares the attacker-supplied HMAC tag against the freshly computed HMAC using PHP/Zephir identity comparison, which lowers to a…","severity":"none","cwe":["CWE-208","CWE-347"],"published":"2026-07-10","updated":"2026-07-10","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54736","references":[{"url":"https://github.com/phalcon/cphalcon/commit/ad53ab1b2e7ec59b3af92b0b37b8aaa099011137","label":"security-advisories@github.com"},{"url":"https://github.com/phalcon/cphalcon/issues/17090","label":"security-advisories@github.com"},{"url":"https://github.com/phalcon/cphalcon/pull/17091","label":"security-advisories@github.com"},{"url":"https://github.com/phalcon/cphalcon/releases/tag/v5.14.1","label":"security-advisories@github.com"},{"url":"https://github.com/phalcon/cphalcon/security/advisories/GHSA-8jqh-95g6-7jpj","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.0018,"epssPercentile":0.07879,"ingestedAt":"2026-07-11T22:16:00.554Z","slug":"CVE-2026-54736","body":"## Overview\n\nPhalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, Phalcon\\Encryption\\Crypt::decrypt compares the attacker-supplied HMAC tag against the freshly computed HMAC using PHP/Zephir identity comparison, which lowers to a byte-wise comparison that returns early on the first differing byte. This observable timing discrepancy can allow an attacker to recover a valid tag byte-by-byte and attach it to a chosen IV and ciphertext so that decrypt() accepts tampered encrypted content as authentic. This issue is fixed in version 5.14.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}