{"action":"Upgrade phalcon/cphalcon to 5.14.1 or later.","affected":[{"fixed":"5.14.1","introduced":"0"}],"component":"phalcon/cphalcon","cve_ids":["CVE-2026-54736"],"ecosystem":"Packagist","epss":0.0018,"exploited":false,"fixed_versions":["5.14.1"],"ghsa_id":"GHSA-8jqh-95g6-7jpj","id":"tcs_01M5KEZ4C37JG7ZKSAGM7KFSWN","modified_at":"2026-08-28T16:15:06.432419689Z","published_at":"2026-08-28T16:01:05Z","references":["https://osv.dev/vulnerability/GHSA-8jqh-95g6-7jpj","https://github.com/phalcon/cphalcon/security/advisories/GHSA-8jqh-95g6-7jpj","https://nvd.nist.gov/vuln/detail/CVE-2026-54736","https://github.com/phalcon/cphalcon/issues/17090","https://github.com/phalcon/cphalcon/pull/17091","https://github.com/phalcon/cphalcon/commit/ad53ab1b2e7ec59b3af92b0b37b8aaa099011137","https://github.com/phalcon/cphalcon","https://github.com/phalcon/cphalcon/releases/tag/v5.14.1"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-8jqh-95g6-7jpj","url":"https://osv.dev/vulnerability/GHSA-8jqh-95g6-7jpj"},{"source":"nvd","source_id":"CVE-2026-54736","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54736"}],"summary":"Phalcon: Non-constant-time HMAC verification in `Encryption\\Crypt::decrypt` (timing side-channel)"}