CVE-2026-61452 MEDIUM

CVE-2026-61452: Grav before 2.0.4 Improper Session Invalidation JWT Access Tokens

Vendor Getgrav
Product grav
Weakness CWE-613 · Insufficient session expiration
Published July 15, 2026
Last update July 15, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password change, new token issuance, or account disablement. An attacker who has stolen an access token retains full API access until the token naturally expires.

Key dates

02Disclosure timeline

July 15, 2026 CVE published
July 15, 2026 Record updated