CVE-2026-72700

Name of the Vulnerable Software and Affected Versions getgrav/grav-plugin-login versions prior to 3.9.1

Description The getgrav/grav-plugin-login Composer plugin uses a non-constant-time === string comparison instead of hash equals() when verifying password reset and account activation tokens. This occurs within the taskReset() function in classes/Controller.php and the activation handler in login.php. Additionally, the token-submission endpoint taskReset lacks rate limiting. These factors could allow an attacker to send repeated token guesses for a known username and use timing differences to attempt to recover a valid token. A timing attack is a side-channel attack where an attacker tries to compromise a system by analyzing the time it takes to execute specific operations.

Recommendations Update getgrav/grav-plugin-login to version 3.9.1 or later.