CVE-2026-61452CWE-613

Grav before 2.0.4 Improper Session Invalidation JWT Access Tokens

Medium · published July 15, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
24.3
In the wild
Unconfirmed
What it is

The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password change, new token issuance, or account disablement. An attacker who has stolen an access token retains full API access until the token naturally expires.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00325 · 24.3th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-07-15T11:25Z
EPSS history
Timeline
  • 15 JUL 11:25Z
    Grav before 2.0.4 Improper Session Invalidation JWT Access Tokens
    cvelistv5