CVE-2026-61452 Grav before 2.0.4 Improper Session Invalidation JWT Access Tokens
Attackers with stolen JWT access tokens retain API access despite logout or account changes because tokens lack revocation identifiers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-61452?
CVE-2026-61452 is a medium-severity vulnerability in getgrav grav, published on 15 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password change, new token issuance, or account disablement. An attacker who has stolen an access token retains full API access until the token naturally expires.
Weakness: CWE-613
Which versions are affected by CVE-2026-61452?
How do I fix CVE-2026-61452?
No fix has been published for CVE-2026-61452 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-61452 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61452 exists.
Sources
Also known as CVE-2026-61829, GHSA-m8g9-wxhx-6f86, GHSA-rrr3-rpgw-867x.