Description
The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password change, new token issuance, or account disablement. An attacker who has stolen an access token retains full API access until the token naturally expires.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| getgrav | grav | < 2.0.4 | 2.0.4 |
References
- GitHub Security Advisory (GHSA-m8g9-wxhx-6f86) vendor-advisory
- VulnCheck Advisory: Grav before 2.0.4 Improper Session Invalidation JWT Access Tokens third-party-advisory