CVE-2026-61452

Description

The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password change, new token issuance, or account disablement. An attacker who has stolen an access token retains full API access until the token naturally expires.

References

https://www.vulncheck.com/advisories/grav-before-improper-session-invalidation-jwt-access-tokens

https://github.com/getgrav/grav/security/advisories/GHSA-m8g9-wxhx-6f86

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4