CVE-2026-61452: Grav before 2.0.4 Improper Session Invalidation JWT Access Tokens
The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password change, new token issuance, or account disablement. An attacker who has stolen an access token retains full API access until the token naturally expires.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
getgrav/grav-plugin-apito a version that resolves this vulnerability.Fixed in 2.0.4 - Compensating control
Because stolen JWT access tokens (default 1 hour) cannot be revoked server-side when issued without a jti, restrict API access to reduce impact until tokens naturally expire.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61452?
CVE-2026-61452 has a medium severity rating of 6.9.
How do I fix CVE-2026-61452?
To fix CVE-2026-61452, upgrade the Grav API plugin to version 2.0.4 or later.
What is the risk associated with CVE-2026-61452?
CVE-2026-61452 comes with a risk score of 33, indicating a potential security issue.
What vulnerability does CVE-2026-61452 describe?
CVE-2026-61452 describes an improper session invalidation vulnerability in Grav where JWT access tokens lack a jti claim.
What impact does CVE-2026-61452 have on JWT tokens?
CVE-2026-61452 allows JWT access tokens to remain valid for their full lifetime without the ability for server-side revocation.