CVE-2026-61452: Grav API Plugin Auth Bypass Vulnerability

CVE-2026-61452 Overview

CVE-2026-61452 affects the Grav API plugin (getgrav/grav-plugin-api) in versions before 2.0.4. The plugin issues JSON Web Token (JWT) access tokens without a jti (JWT ID) claim, preventing server-side revocation. Access tokens remain valid for their full lifetime, which defaults to one hour. Logout, password changes, new token issuance, and account disablement do not invalidate previously issued tokens. An attacker who has stolen an access token retains full API access until the token naturally expires. The vulnerability is classified under CWE-613: Insufficient Session Expiration.

Critical Impact
Stolen JWT access tokens cannot be revoked and remain valid for up to one hour, granting attackers full API access despite defensive actions such as password resets or account disablement.

Affected Products

Grav CMS API plugin (getgrav/grav-plugin-api) versions prior to 2.0.4
Grav installations that expose the API plugin over the network
Any downstream integrations relying on the plugin for JWT-based authentication

Discovery Timeline

2026-07-15 - CVE-2026-61452 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-61452

Vulnerability Analysis

The Grav API plugin uses JWT for API authentication. JWTs are stateless by design, and revocation typically requires a server-side identifier such as the jti claim tied to a revocation list or session store. The plugin omits the jti claim from access tokens, so the server has no reliable way to blacklist a specific token.

Refresh tokens in the plugin implement proper revocation. Access tokens, however, remain trusted until their expiration timestamp elapses. This asymmetry breaks the security model that administrators expect when disabling accounts or rotating credentials.

An attacker who obtains a valid access token through phishing, log exposure, browser compromise, or interception can continue calling protected API endpoints. Defensive actions taken by administrators produce no immediate effect on the stolen token.

Root Cause

The root cause is improper session invalidation [CWE-613]. The token issuance logic does not include a unique jti claim, and the validation logic does not consult a revocation store. As a result, token validity is bound only to the expiration (exp) claim.

Attack Vector

Exploitation requires the attacker to first obtain a valid access token. Once acquired, the attacker sends authenticated HTTP requests to the Grav API using the token in the Authorization: Bearer header. Requests succeed until the token's exp value is reached. No network privilege or user interaction is required to reuse the token beyond initial theft.

The vulnerability mechanics are documented in the GitHub Security Advisory GHSA-m8g9-wxhx-6f86 and the VulnCheck Advisory on Grav.

Detection Methods for CVE-2026-61452

Indicators of Compromise

API requests carrying Authorization: Bearer tokens from IP addresses or user agents inconsistent with the token owner's normal behavior
Continued successful API calls from a user account after an administrator has disabled the account or reset the password
JWTs in access logs that lack a jti claim when decoded

Detection Strategies

Decode and inspect JWTs observed in API traffic to confirm whether the jti claim is present
Correlate authentication events with subsequent API activity to identify token reuse following logout or password change
Alert on any API call authenticated with a token belonging to a disabled or deleted user account

Monitoring Recommendations

Log every API request including the token subject (sub), issuance time (iat), and source IP for retrospective analysis
Monitor for spikes in API request volume from a single token, which may indicate automated abuse of a stolen credential
Track discrepancies between administrator revocation actions and continued authenticated activity for the affected principal

How to Mitigate CVE-2026-61452

Immediate Actions Required

Upgrade the Grav API plugin to version 2.0.4 or later, which introduces server-side token revocation
Reduce the access token lifetime configuration to the shortest value acceptable for operational needs
Audit historical API logs for authenticated activity that occurred after logout, password reset, or account disablement events

Patch Information

The maintainers released a fix in getgrav/grav-plugin-api version 2.0.4. The patched version includes a jti claim in issued access tokens and adds server-side revocation checks. Full details are provided in the GitHub Security Advisory.

Workarounds

Shorten the access token time-to-live (TTL) in plugin configuration to limit the exposure window when a token is stolen
Restrict API access at the network layer using firewall rules or a reverse proxy that enforces IP allowlisting
Rotate the JWT signing secret when a token compromise is suspected, which invalidates all previously issued tokens

bash

# Update the Grav API plugin via Composer to the fixed version
composer require getgrav/grav-plugin-api:^2.0.4

# Verify the installed version
composer show getgrav/grav-plugin-api | grep versions