Executive brief
The Grav API plugin, which provides programmatic access to the Grav content management system, fails to properly invalidate user sessions. When a user logs out or changes their password, their existing access tokens remain active and usable for up to one hour. If an attacker steals one of these tokens, they can continue to access and modify site data even after the legitimate user has taken security precautions like resetting their credentials.
Technical details
The vulnerability exists in the `JwtAuthenticator.php` component of the Grav API plugin. While refresh tokens include a `jti` (JWT ID) claim and are checked against a server-side revocation list, access tokens are issued without this claim. Consequently, the `validateToken` function lacks a mechanism to verify if an access token has been revoked. An attacker who obtains a valid access token (e.g., via XSS or log leakage) can maintain full API access for the duration of the token's TTL (default 3600 seconds), as the server cannot invalidate the token upon logout, password change, or account suspension. The issue is resolved in version 2.0.4 by adding the `jti` claim to access tokens and implementing revocation checks during validation.
Affected products
- getgrav grav-plugin-api < 2.0.4
Timeline
- 2026-06-25: advisory: Vendor advisory published on GitHub
- 2026-07-15: disclosed: NVD publication date