# CVE-2026-61452: Grav API plugin improper session invalidation in JWT access tokens

Source: https://junglewise.ai/threats/cve-2026-61452-grav-api-plugin-improper-session-invalidation-in-jwt-access  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-61452 · Severity: medium · CVSS 5.3 · Published 2026-07-15

The Grav API plugin, which provides programmatic access to the Grav content management system, fails to properly invalidate user sessions. When a user logs out or changes their password, their existing access tokens remain active and usable for up to one hour. If an attacker steals one of these tokens, they can continue to access and modify site data even after the legitimate user has taken security precautions like resetting their credentials.

Technologies: [Grav API Plugin](https://junglewise.ai/threats/technologies/api-plugin). Vendors: [Grav](https://junglewise.ai/threats/vendors/grav).

## Quick answers

**Is CVE-2026-61452 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61452 being exploited in the wild.

**How severe is CVE-2026-61452?** Medium severity, with a CVSS score of 5.3, published 15 July 2026.

**Which products and versions are affected?** Grav API Plugin < 2.0.4.

**Is there a fix for CVE-2026-61452?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-61452 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61452?** Check whether you run Grav API Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the `JwtAuthenticator.php` component of the Grav API plugin. While refresh tokens include a `jti` (JWT ID) claim and are checked against a server-side revocation list, access tokens are issued without this claim. Consequently, the `validateToken` function lacks a mechanism to verify if an access token has been revoked. An attacker who obtains a valid access token (e.g., via XSS or log leakage) can maintain full API access for the duration of the token's TTL (default 3600 seconds), as the server cannot invalidate the token upon logout, password change, or account suspension. The issue is resolved in version 2.0.4 by adding the `jti` claim to access tokens and implementing revocation checks during validation.

## Affected products

- getgrav grav-plugin-api < 2.0.4

## Timeline

- 2026-06-25: advisory: Vendor advisory published on GitHub
- 2026-07-15: disclosed: NVD publication date

## References

- [https://github.com/getgrav/grav/security/advisories/GHSA-m8g9-wxhx-6f86](https://github.com/getgrav/grav/security/advisories/GHSA-m8g9-wxhx-6f86)
- [https://www.vulncheck.com/advisories/grav-before-improper-session-invalidation-jwt-access-tokens](https://www.vulncheck.com/advisories/grav-before-improper-session-invalidation-jwt-access-tokens)

## Related threats

- [Grav API plugin session validation bypass in disabled accounts](https://junglewise.ai/threats/cve-2026-109320-the-grav-api-plugin-grav-plugin-api-before-1-0-36-contains-an)
- [Grav API Plugin password reset link spoofing via Host header](https://junglewise.ai/threats/cve-2026-86196-grav-api-plugin-password-reset-link-spoofing-via-host-header)
- [Grav API Plugin scope cap bypass in page permissions](https://junglewise.ai/threats/cve-2026-80204-grav-api-plugin-scope-cap-bypass-in-page-permissions)
- [Grav API plugin server-side request forgery in webhook delivery](https://junglewise.ai/threats/cve-2026-56708-grav-api-plugin-server-side-request-forgery-in-webhook-delivery)
- [Grav API Plugin privilege escalation in API key management](https://junglewise.ai/threats/cve-2026-64852-grav-api-plugin-privilege-escalation-in-api-key-management)