Vulnerability · Published Jul 15, 2026 · Assigned by VulnCheck

CVE-2026-61452Grav before 2.0.4 Improper Session Invalidation JWT Access Tokens

Medium 5.3

In plain English

A medium-severity security flaw in grav from getgrav. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 84.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password change, new token issuance, or account disablement. An attacker who has stolen an access token retains full API access until the token naturally expires.

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav	0 – before 2.0.4

Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-m8g9-wxhx-6f86) vendor-advisory
VulnCheck Advisory: Grav before 2.0.4 Improper Session Invalidation JWT Access Tokens third-party-advisory