CVE-2026-61452

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 2.0.4

Description Improper session invalidation occurs because JSON Web Tokens (JWT) access tokens are issued without a jti (JWT ID) claim, preventing server-side revocation. While refresh tokens can be managed, access tokens remain valid for their entire duration (defaulting to 1 hour) even after a user logs out, changes their password, receives a new token, or has their account disabled. This allows an attacker with a stolen access token to maintain full API access until the token expires naturally.

Recommendations Update Grav API plugin to version 2.0.4 or later.