PT-2026-60146 · Getgrav · Grav

Alienkeric · Publicado 2026-07-15 · Atualizado 2026-07-15 · CVE-2026-61452

Mitre

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password change, new token issuance, or account disablement. An attacker who has stolen an access token retains full API access until the token naturally expires.

Exploit

Correção

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

CVE-2026-61452

Produtos afetados

Grav

Referências · 3

• 🔥 https://github.com/getgrav/grav/security/advisories/GHSA-m8g9-wxhx-6f86 · Exploit
• https://vulncheck.com/advisories/grav-before-improper-session-invalidation-jwt-access-tokens · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-61452 · Nota de Segurança