CyberRota Analysis
AI-GeneratedThe Grav API plugin prior to version 2.0.4 is vulnerable due to improper session invalidation, allowing JWT access tokens to be issued without a revocable jti claim. This flaw enables stolen access tokens to remain valid for their full lifetime, potentially granting unauthorized API access even after user actions like logout or password changes. Organizations using this plugin should prioritize patching to mitigate the risk of token theft and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password change, new token issuance, or account disablement. An attacker who has stolen an access token retains full API access until the token naturally expires.