CVE-2026-55250: CWE-294: Authentication Bypass by Capture-replay in macropay-solutions maravel-framework

CVE-2026-55250 affects macropay-solutions maravel-framework prior to version 10.74.0 and involves a token replay vulnerability caused by a structural lifecycle mismatch between stateless token validation and relational caching layers. The tymon/jwt-auth package uses cache tags to store 14-day JWT blacklist entries, but a global cache eviction ceiling of 2 hours truncates this lifespan, causing blacklisted tokens to expire prematurely from cache. Additionally, cache flushes reset internal version pointers, invalidating blacklist records. As a result, tokens that should be blacklisted remain valid and can be replayed across the API gateway. The root cause is an architectural assumption in tymon/jwt-auth, not a core framework defect. Maravel 10.74.0 introduces a backported fix that decouples token identifiers from tagged caches, preventing premature eviction. The recommended workaround is to avoid cache memory conditions that cause early evictions and to store token identifiers as flat, untagged key-value pairs to maintain their full 14-day lifecycle.

The vulnerability allows attackers to replay JWT tokens that have been blacklisted or logged out because the blacklist entries are prematurely evicted from cache due to a forced 2-hour eviction ceiling and cache flushes. This leads to critical authentication bypass, enabling unauthorized access to API endpoints for up to 14 days after token invalidation. The impact is high severity given the potential for widespread token reuse and unauthorized access.

A fix is available in maravel-framework version 10.74.0, which introduces a backported tagged cache implementation that resolves the lifecycle mismatch. Users should upgrade to version 10.74.0 or later. Until upgrading, apply the recommended workaround by configuring the cache to prevent early evictions that delete blacklisted JWT IDs prematurely. Additionally, decouple authentication token identifiers from the relational tagging subsystem by storing them as flat, untagged key-value pairs to preserve their full 14-day blacklist lifespan.