CVE-2026-61452

Summary

The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password change, new token issuance, or account disablement. An attacker who has stolen an access token retains full API access until the token naturally expires.

Affected Software

Weaknesses

• CWE-613: Insufficient Session Expiration

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: partial

Additional References

• https://github.com/getgrav/grav/security/advisories/GHSA-m8g9-wxhx-6f86

References

• https://github.com/getgrav/grav/security/advisories/GHSA-m8g9-wxhx-6f86
• https://www.vulncheck.com/advisories/grav-before-improper-session-invalidation-jwt-access-tokens

• ←Previous
• Next→