CVE-2026-55250: Maravel Framework Auth Bypass Vulnerability

CVE-2026-55250 Overview

CVE-2026-55250 affects Maravel, a PHP framework oriented toward dependency injection, prior to version 10.74.0. The flaw is a Token Replay Vulnerability [CWE-294] caused by a lifecycle mismatch between stateless JSON Web Token (JWT) validation and relational tagged cache layers. Applications using macropay-solutions/maravel-framework with tymon/jwt-auth for API authentication and blacklist management are affected. The issue also extends to native Laravel deployments that rely on cache tags under volatile or eviction-capped conditions. Attackers can replay stolen, hijacked, or logged-out JWTs after blacklist entries silently disappear from the cache, bypassing invalidation controls.

Critical Impact

Revoked JWTs remain valid for up to 14 days after their blacklist entries are evicted or flushed, enabling silent token replay across the entire API gateway.

Affected Products

• macropay-solutions/maravel-framework prior to version 10.74.0
• Applications using tymon/jwt-auth with cache tag support enabled
• Native Laravel applications leveraging cache tags in eviction-capped or volatile cache environments

Discovery Timeline

• 2026-09-08 - CVE-2026-55250 published to the National Vulnerability Database (NVD)
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-55250

Vulnerability Analysis

The vulnerability arises from a structural mismatch between JWT blacklist lifetimes and the tagged cache subsystem. tymon/jwt-auth probes for cache tag support and, when detected, wraps 14-day blacklist entries (jti identifiers) inside a tymon.jwt tag namespace. In Maravel environments running the O(1) Atomic Lazy Eviction model, the container enforces a Container::TAGGED_CACHE_TTL_CAP_SECONDS ceiling of 7,200 seconds. This ceiling truncates the intended 14-day blacklist window to a maximum of two hours.

After the ceiling elapses or after any Cache::tags([...])->flush() invocation, blacklist tracking keys are wiped. Because the JWT signatures remain cryptographically valid for the full 14 days, previously invalidated tokens are silently resurrected. Attackers holding stolen or logged-out tokens can replay them across the API gateway without triggering authentication failures.

Root Cause

The root cause is a lifecycle collision between the tagged cache generational version matrix and long-lived JWT blacklist entries. The optimized engine achieves O(1) flush performance by bumping an atomic master version pointer, which changes the computed composite hash sha1($this->tags->getNamespace()). Any flush renders the entire prior blacklist index immediately unreachable. The upstream assumption in tymon/jwt-auth that tagged entries persist for their full time-to-live (TTL) does not hold under Maravel's eviction and versioning model.

Attack Vector

An attacker who obtains a valid JWT through interception, credential theft, or session hijacking waits for either the two-hour tag TTL cap to elapse or for a tag flush event triggered by cache pressure. Once the blacklist entry disappears, the attacker replays the token against the API. The server validates the signature, finds no blacklist record, and grants access. Exploitation requires network access to the API and no user interaction. See the Macropay Solutions Laravel Docs for architectural context.

Detection Methods for CVE-2026-55250

Indicators of Compromise

• Successful API authentication using JWT jti values that were previously passed to the blacklist logout endpoint.
• Reappearance of previously revoked tokens after cache eviction events or scheduled tag flushes.
• Absence of expected jti entries in the tymon.jwt tagged cache namespace within the 14-day window.

Detection Strategies

• Audit application logs to correlate logout events with subsequent successful requests bearing the same jti claim.
• Instrument the JWT blacklist middleware to record cache lookup misses for tokens whose issuance timestamp is older than two hours.
• Compare blacklist entry counts against expected retention volume; sharp drops indicate premature eviction or tag flush activity.

Monitoring Recommendations

• Track cache backend memory utilization and eviction counters to identify environments prone to premature key removal.
• Alert on invocations of Cache::tags(['tymon.jwt'])->flush() and unexpected changes to tagged cache namespace hashes.
• Forward authentication and cache telemetry into a centralized analytics pipeline to detect token replay patterns across gateways.

How to Mitigate CVE-2026-55250

Immediate Actions Required

• Upgrade macropay-solutions/maravel-framework to version 10.74.0 or later to obtain the backported tagged cache fix from the 20.x branch.
• Reconfigure tymon/jwt-auth to store blacklist entries in a flat, un-tagged keyspace so that the full 14-day TTL is preserved.
• Increase cache backend memory or adjust eviction policies to prevent premature removal of blacklisted jti entries.

Patch Information

Maravel 10.74.0 introduces the fixed tagged cache implementation by resolving TagSet and TaggedCache from the dependency injection container, as described in PR #104. Because the underlying architectural assumption originates in tymon/jwt-auth, no framework upgrade alone resolves the collision without adopting the decoupled configuration workaround. Refer to the Packagist package listing for release details and the GitHub Wiki for Maravel for upgrade guidance.

Workarounds

• Decouple JWT blacklist storage from the relational tagging subsystem so that jti identifiers write directly to the primary cache keyspace as flat key-value pairs.
• Ensure cache memory capacity is sized to avoid natural evictions that would remove blacklisted tokens before their 14-day expiration.
• Avoid programmatic or scheduled tag flushes against namespaces overlapping with tymon.jwt entries.

# Configuration example: disable cache tag wrapping for JWT blacklist entries
# in config/jwt.php, ensure the blacklist store points to a driver
# where tag support is not used, and keep TTL aligned with token lifetime.
'blacklist_enabled' => true,
'blacklist_grace_period' => 0,
'ttl' => 20160, # 14 days in minutes
'blacklist_storage' => 'flat', # use un-tagged keyspace