Maravel framework versions before 10.74.0 suffer from a token replay vulnerability caused by a structural lifecycle mismatch between stateless token validation and a high-performance relational caching layer. The tymon/jwt-auth package uses cache tags to manage a 14-day token blacklist, but a global cache TTL cap of 2 hours truncates blacklist entries prematurely. Additionally, cache tag flushes reset internal version pointers, invalidating blacklist records instantly. As a result, tokens that should be blacklisted remain valid for up to 14 days, enabling replay attacks. This flaw stems from architectural assumptions in tymon/jwt-auth rather than a core framework defect. Version 10.74.0 backports a fixed tagged cache from 20.x but requires users to apply a configuration workaround to decouple token blacklist storage from the tagging subsystem, ensuring tokens retain their full 14-day blacklist lifespan.

The vulnerability allows attackers to reuse blacklisted JWT tokens after cache eviction or flush events, bypassing authentication controls. This can lead to unauthorized access to APIs protected by the maravel-framework using tymon/jwt-auth for token authentication. The tokens remain cryptographically valid for up to 14 days despite being blacklisted, enabling widespread token replay attacks. This undermines the security of applications relying on token blacklisting for session invalidation or logout enforcement.

No official patch or direct framework upgrade fully resolves this issue as it originates from architectural assumptions in the tymon/jwt-auth package. Users should apply the documented workaround by configuring the system to decouple token blacklist entries from the relational tagging cache. Specifically, token identifiers must be stored as flat, un-tagged key-value pairs in the primary cache keyspace to preserve their full 14-day lifecycle. Additionally, ensure cache memory is sized to prevent premature evictions that delete blacklist entries early. Monitor vendor advisories for any future official fixes.