CVE-2026-72701

Name of the Vulnerable Software and Affected Versions Grav CMS versions prior to 2.0.16

Description An issue exists in the verifyNonce() function of the Utils class where non-constant-time string comparison is performed using the === operator instead of hash equals() for CSRF nonce validation. This allows attackers to recover valid nonce values byte-by-byte by measuring response timing differences across multiple requests, which reduces the effectiveness of Cross-Site Request Forgery (CSRF) protection.

Recommendations Update Grav CMS to version 2.0.16 or later.