fkie_cve-2026-54736

Phalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, Phalcon\Encryption\Crypt::decrypt compares the attacker-supplied HMAC tag against the freshly computed HMAC using PHP/Zephir identity comparison, which lowers to a byte-wise comparison that returns early on the first differing byte. This observable timing discrepancy can allow an attacker to recover a valid tag byte-by-byte and attach it to a chosen IV and ciphertext so that decrypt() accepts tampered encrypted content as authentic. This issue is fixed in version 5.14.1.

GHSA-8jqh-95g6-7jpj — Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)

Affected: Packagist: phalcon/cphalcon

## Summary

`Phalcon\Encryption\Crypt` provides authenticated encryption: when `useSigning` is enabled (the default), `encrypt()` appends an HMAC tag and `decrypt()` verifies it before returning the plaintext. The verification compares the attacker-supplied tag against the freshly computed HMAC using PHP/Zephir identity comparison (`!==`), which the Zephir compiler lowers to `!ZEPHIR_IS_IDENTICAL(...)` — a byte-wise `memcmp` that returns early on the first differing byte. The comparison time therefore depends on how many leading bytes of the supplied tag are correct, a classic MAC-verification timing side-channel. Every other secret/MAC comparison in the framework uses the constant-time `hash_equals()` (`zephir_hash_equals`) — the CSRF token check (`Security::checkToken`) and the JWT signature check (`Signer\Hmac::verify`); `Crypt::decrypt` is the lone deviation.

## Details

### Vulnerable code

`phalcon/Encryption/Crypt.zep:246` (Zephir source):

```zephir if true === this->useSigning { // Checks on the decrypted message digest using the HMAC method. if digest !== hash_hmac(hashAlgorithm, padded, decryptKey, true) { throw new Mismatch("Hash does not match."); } } ```

Generated C --> `ext/phalcon/encryption/crypt.zep.c:364-367`:

```c ZEPHIR_CALL_FUNCTION(&_8$$7, "hash_hmac", NULL, 245, &hashAlgorithm, &padded, &decryptKey, &__$true); ... if (!ZEPHIR_IS_IDENTICAL(&digest, &_8$$7)) { // <-- non-constant-time ZEPHIR_THROW_EXCEPTION_DEB…

Most recent entries from all

fkie_cve-2026-54736

GHSA-8jqh-95g6-7jpj — Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)