Description (CNA)
The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password change, new token issuance, or account disablement. An attacker who has stolen an access token retains full API access until the token naturally expires.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| getgrav / grav | affected 0 before 2.0.4; unaffected 2.0.4 |
CWE
CWE-613
References
- https://github.com/getgrav/grav/security/advisories/GHSA-m8g9-wxhx-6f86
- https://www.vulncheck.com/advisories/grav-before-improper-session-invalidation-jwt-access-tokens
ADP enrichment
No English description supplied.