Back to overview

CVE-2026-61452

MEDIUM Exploitation: PoC
5.3
CVSS 3.1
Description
The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password change, new token issuance, or account disablement. An attacker who has stolen an access token retains full API access until the token naturally expires.

Metadata

CVE ID
CVE-2026-61452
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-07-09 14:06 UTC
Published
2026-07-15 11:25 UTC
Last updated
2026-07-15 13:52 UTC
Primary CWE
CWE-613
Insufficient Session Expiration
Vendor / Product
getgrav / grav
Sources
cve.org  ·  NVD

Severity & Metrics

5.3 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
yes
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
getgrav grav — 0 < 2.0.4, 2.0.4
Weakness (CWE)
CWESourceDescription
CWE-613 cna Insufficient Session Expiration
CVSS scores (2)
ScoreSeverityVersionSourceVector
6.9 MEDIUM 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
5.3 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References (2)
Back to overview