CVE-2020-9588: Magento Signature verification bypass

The vulnerability stems from an observable timing discrepancy during signature verification. In PHP applications, this typically occurs when comparing cryptographic signatures using non-constant time string comparison methods. Magento's Security::compareStrings function is a prime candidate as it's responsible for secure string comparisons. The vulnerability description matches the pattern where such a function would use simple string equality checks (via '==' or early-exit comparisons) rather than constant-time algorithms like hash_equals(). While no direct patch code is available, this function's role in security-critical comparisons and the nature of the CWE-203 vulnerability strongly indicate it as the source.