CVE-2026-106466: JWT Auth <= 3.0.2 - Unauthenticated Account Access Persistence via Insufficient Refresh Token Revocation
The JWT Auth WordPress plugin through 3.0.2 does not invalidate previously issued refresh tokens when a user changes or resets their password or removes a connected device, allowing an attacker who obtained a refresh token before such an event to keep issuing valid access tokens and retain authenticated access to the account, up to Administrator.
Affected Software
Event History
Frequently Asked Questions
What must an attacker have to retain access?
The attacker must already possess a refresh token issued for the target account. They can then continue exchanging it for valid access tokens after the user changes or resets their password or removes a connected device.
Which accounts could be impacted?
Any account for which an attacker obtained a refresh token could be affected. The retained access carries the privileges of that account, including Administrator-level access when the compromised account is an administrator.
Will changing the password or removing a connected device end the attacker’s session?
No. In affected versions, those actions do not invalidate previously issued refresh tokens, so they do not prevent a holder of an older refresh token from obtaining new access tokens.