CVE-2026-61452

EUVD-2026-44649
The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password change, new token issuance, or account disablement. An attacker who has stolen an access token retains full API access until the token naturally expires.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
getgravgrav
𝑥
< 2.0.4
CNA
Common Weakness Enumeration
References
https://github.com/getgrav/grav/security/advisories/GHSA-m8g9-wxhx-6f86
https://www.vulncheck.com/advisories/grav-before-improper-session-invalidation-jwt-access-tokens
https://github.com/getgrav/grav/security/advisories/GHSA-m8g9-wxhx-6f86