CVE-2026-61452
MEDIUMGrav before 2.0.4 Improper Session Invalidation JWT Access Tokens
Title source: cnaDescription
The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password change, new token issuance, or account disablement. An attacker who has stolen an access token retains full API access until the token naturally expires.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-m8g9-wxhx-6f86)
https://github.com/getgrav/grav/security/advisories/GHSA-m8g9-wxhx-6f86
Third Party Advisory third-party-advisory
VulnCheck Advisory: Grav before 2.0.4 Improper Session Invalidation JWT Access Tokens
https://www.vulncheck.com/advisories/grav-before-improper-session-invalidation-jwt-access-tokens
Scores
CVSS v3
5.3
EPSS
0.0019
EPSS Percentile
9.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-613
Status
published
Products (2)
getgrav/grav
< 2.0.4
getgrav/grav
2.0.4
Published
Jul 15, 2026
Tracked Since
Jul 15, 2026