Phalcon’s Encryption\\Crypt::decrypt performed HMAC tag verification with a PHP/Zephir identity comparison that short‑circuits on the first mismatched byte. This implementation leak allows an attacker to measure response times and recover the valid tag one byte at a time. Once the tag is known, the attacker can attach it to any chosen IV and ciphertext, causing decrypt() to accept tampered data as authentic. The flaw is a classic timing information leak (CWE‑208) and a timing‑dependent forced return (CWE‑347).

The vulnerable code exists in the Phalcon PHP framework (cphalcon) and applies to all releases before version 5.14.1. Any application using Phalcon’s built‑in encryption functions before this release is affected.

The CVSS score of 8.2 classifies this as high severity. The EPSS score of 0.00147 indicates a very low probability of exploitation, yet the potential for an active timing side‑channel makes exploitation feasible for remote attackers who can observe decryption responses over the network. It is not currently featured in the CISA KEV catalog. The likely attack vector is a remote network attacker sending crafted requests to an exposed application endpoint and measuring decryption timing to iteratively recover the HMAC tag.