The getgrav/grav-plugin-login Composer plugin before 3.9.1 (used by Grav) compares password reset and account activation tokens using a non-constant-time === string comparison instead of hash_equals() in classes/Controller.php (taskReset()) and login.php (activation handler). Because the token-submission endpoint (taskReset) also lacks rate limiting, an attacker could in principle send repeated token guesses against a known username and use the timing differences to attempt to recover a valid token, though the vendor rates the practical exploitability as low and no end-to-end network exploit has been demonstrated.

The getgrav/grav-plugin-login Composer plugin before version 3.9.1 contains a timing side-channel vulnerability in its password reset and account activation token comparison logic. The affected code uses a non-constant-time === string comparison instead of the secure hash_equals() function in classes/Controller.php and login.php. Additionally, the token submission endpoint (taskReset) lacks rate limiting, compounding the risk. An attacker with knowledge of a valid username could theoretically send repeated token guesses and use timing differences to recover a valid reset or activation token. The vendor acknowledges the flaw but rates practical exploitability as low, and no end-to-end network exploit has been publicly demonstrated. The fix is available in version 3.9.1 of the plugin.