CVE-2026-61452 | BDVDB-2026-348752 Detail

Description#

The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password change, new token issuance, or account disablement. An attacker who has stolen an access token retains full API access until the token naturally expires.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-07-15Record published in the CVE List.
2. Version 22026-07-28Most recent update recorded in the CVE List.