The vulnerability stems from a timing side‑channel in Grav CMS’s Utils::verifyNonce() where a non‑constant‑time string comparison with the === operator is used instead of hash_equals(). Attacker requests can be measured to recover a valid CSRF nonce byte by byte, allowing the attacker to forge requests that appear legitimate and bypass the intended CSRF protection. This does not directly provide code execution or data exfiltration but erodes the integrity of the CSRF defense and undermines the security margin that developers rely on.

Grav CMS versions prior to 2.0.16 are vulnerable. The vendor is getgrav and the affected product is Grav CMS. All installations running a pre‑2.0.16 release face the flaw, as identified in the advisory references.

The CVSS score of 6.3 indicates medium severity. No EPSS score is currently available and the flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is HTTP requests to the CSRF verification endpoint, requiring the attacker to measure response timing differences. Practical exploitation demands network access and the ability to send repeated requests; therefore the risk is moderate, especially for publicly exposed sites that do not implement rate limiting or monitoring of anomalous request patterns.