CVE-2026-61452: Grav before 2.0.4 Improper Session Invalidation JWT Access Tokens

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-15 · updated 2026-10-24
Weakness: CWE-613

Description

The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password change, new token issuance, or account disablement. An attacker who has stolen an access token retains full API access until the token naturally expires.

Affected products

getgrav grav: before 2.0.4 — fixed in 2.0.4

How to fix

Upgrade to a fixed version: getgrav grav 2.0.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-61452 or the next vulnerability affects your stack