CVE-2026-61452 describes an improper session invalidation vulnerability in the Grav API plugin (getgrav/grav-plugin-api) prior to version 2.0.4. The issue arises because JWT access tokens are issued without a JWT ID (jti) claim, which is necessary for server-side token revocation. Unlike refresh tokens, these access tokens cannot be revoked upon user logout, password change, new token issuance, or account disablement, allowing continued API access by an attacker who has obtained a valid access token until it expires after its default lifetime of one hour.

An attacker who steals a valid JWT access token can retain full API access for the token's entire lifetime (default one hour) regardless of user logout or account changes. This undermines session invalidation mechanisms and can lead to unauthorized access to protected API resources during that period.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor the vendor's updates for a fix in version 2.0.4 or later. Until a patch is available, consider minimizing token lifetime if configurable or implementing additional controls to detect and block suspicious token use.