The Grav Composer plugin login implementation before version 3.9.1 compares password reset and account activation tokens with a simple string equality check that is not constant‑time. That leaves a distinguishable timing side channel that an attacker can use to infer the correct token. Exploiting this flaw could allow an adversary to recover a valid token for a known username, compromising the ability to reset a password or activate an account. The weakness is categorized as CWE‑208.

The vulnerability affects the Grav CMS project, specifically the getgrav:grav-plugin-login Composer plugin shipped with Grav before version 3.9.1. Versions 3.9.1 and newer contain the patch that replaces the fragile comparison with a secure hash_equals() call.

The CVSS score for this issue is 8.7, indicating a high severity level. The EPSS score is not available, so the overall exploitation probability is uncertain, but the flaw is not listed in the CISA KEV catalog. The exploitation path uses the public token‑submission endpoint (taskReset) which is also unrate‑limited, so an attacker could send repeated guesses and measure response times to converge on a valid token. Vendors rate the practical exploitability as low and have not demonstrated a complete network‑level attack. Nonetheless, the presence of the timing side‑channel and lack of throttling means that a skilled attacker could potentially recover a token in a real attack scenario.