What is GHSA-rrr3-rpgw-867x?

GHSA-rrr3-rpgw-867x is a security advisory published by GitHub Security Advisories with Medium severity. The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session...

Which CVE IDs does GHSA-rrr3-rpgw-867x cover?

GHSA-rrr3-rpgw-867x covers the following CVE IDs: CVE-2026-61452. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rrr3-rpgw-867x?

GHSA-rrr3-rpgw-867x has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-rrr3-rpgw-867xMediumCVSS 5.3

The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session...

Vendor

GitHub Security Advisories

Published

July 15, 2026

Last Modified

July 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-61452 →

📋 Description

The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password change, new token issuance, or account disablement. An attacker who has stolen an access token retains full API access until the token naturally expires.

🔗 References (4)

https://github.com/getgrav/grav/security/advisories/GHSA-m8g9-wxhx-6f86
https://nvd.nist.gov/vuln/detail/CVE-2026-61452
https://www.vulncheck.com/advisories/grav-before-improper-session-invalidation-jwt-access-tokens
https://github.com/advisories/GHSA-rrr3-rpgw-867x