Phalcon CVE-2026-54736

Exploitation requires an application that calls Phalcon\Encryption\Crypt::decrypt on attacker-influenced input and exposes an observable timing signal (or error/latency oracle) reflecting HMAC verification. The attacker must be able to submit chosen IV+ciphertext values with candidate tags and repeatedly measure decrypt timing to recover a valid tag byte-by-byte. No authentication is required (PR:N) and it is network-reachable (AV:N), but exploitation is materially limited by the timing side-channel nature: high attack complexity (AC:H), the need for a large number of low-jitter samples, and the requirement that the application's response timing correlate with the internal byte-wise comparison. Applications that do not surface decrypt timing to attackers, or that already wrap verification in constant-time logic, are not practically exploitable.

The vendor CVSS 4.0 score is 8.2 (High) with vector AV:N/AC:H/AT:N/PR:N/UI:N and VI:H while VC:N/VA:N, meaning the sole impact is to integrity - an attacker can get forged/tampered ciphertext accepted, but confidentiality and availability are not directly affected. The AC:H (high attack complexity) rating is appropriate and important: exploiting a timing side-channel over a network requires many samples, statistical averaging against network jitter, and an oracle that reflects verification timing, so this is not point-and-click. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public exploit was identified - so despite the 8.2 headline this is best treated as a real-but-difficult integrity risk rather than an imminently-weaponized issue. The practical severity depends heavily on how much timing signal an application actually exposes; verify whether decrypt() timing is observable in the specific deployment before rating this urgent.

An application uses Phalcon\Encryption\Crypt to encrypt-then-HMAC a client-visible token (e.g. an authenticated cookie or state blob). An attacker repeatedly submits a chosen IV and ciphertext with guessed tag bytes and measures how long decrypt() takes to reject each, using the early-return timing leak to recover the correct tag one byte at a time until decrypt() accepts the tampered payload as authentic. No public exploit code is identified at time of analysis; the CVSS AC:H rating reflects the many timing samples and network-noise filtering required.