[GHSA] GHSA-38p6-h87p-r4cg (low) — Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection

GHSA-38p6-h87p-r4cg Severity: low CVE: CVE-2026-72701

Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection

## Summary

`Grav\Common\Utils::verifyNonce()`, the core function Grav and its plugins use to validate CSRF nonces, compares the submitted nonce to the expected value with PHP's `===` operator instead of `hash_equals()`. `===` on strings short circuits a