CVE-2026-61452 describes an improper session invalidation vulnerability in the Grav API plugin before version 2.0.4. The issue arises because JWT access tokens are issued without a jti claim, which is necessary for server-side token revocation. Unlike refresh tokens, these access tokens cannot be revoked early and remain valid for their configured lifetime, typically one hour. Consequently, if an attacker steals an access token, they retain full API access until the token expires, regardless of user logout or credential changes.

An attacker who obtains a valid JWT access token can continue to access the API with the privileges of the token holder until the token expires naturally. This undermines session termination mechanisms such as logout, password changes, or account disabling, potentially allowing unauthorized access for up to the token lifetime (default one hour). No privilege escalation or code execution is indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor the vendor's updates for a fix in version 2.0.4 or later. Until a patch is available, consider reducing the access token lifetime if configurable, and ensure secure handling and storage of tokens to minimize theft risk.