[HIGH] Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)

PKSA-65xj-m5g6-56k1 CVE-2026-54736 GHSA-8jqh-95g6-7jpj

Affected package: phalcon/cphalcon

Affected version: <=5.14.0

Reported by:
GitHub