Medium severity · published Jul 15, 2026
CVE-2026-61452
Grav before 2.0.4 Improper Session Invalidation JWT Access Tokens
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password change, new token issuance, or account disablement. An attacker who has stolen an access token retains full API access until the token naturally expires.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
grav · getgrav
before 2.0.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-61452
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-61452
github.com
https://github.com/getgrav/grav/security/advisories/GHSA-m8g9-wxhx-6f86
www.vulncheck.com
https://www.vulncheck.com/advisories/grav-before-improper-session-invalidation-jwt-access-tokens
More from grav
9.9
CVE-2024-34082
Grav Arbitrary File Read to Account Takeover
9.8
CVE-2026-80203
Grav before 1.0.18 Authentication Bypass via Scoped API Key
9.8
CVE-2026-56710
Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock
9.8
CVE-2026-65008
Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData
9.8
CVE-2021-47812
GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)