Threat Intelligence Database

Maravel Framework versions prior to 10.74.0 have a high-severity token replay vulnerability due to a lifecycle mismatch between stateless token validation and relational caching layers. This flaw causes blacklisted JWT tokens to be prematurely evicted from cache, allowing them to be reused for up to 14 days. The issue arises from the tymon/jwt-auth package's use of cache tags with a forced 2-hour eviction ceiling, which truncates the intended 14-day blacklist lifespan. Cache flushes or natural evictions invalidate blacklist records, enabling token replay attacks. The vulnerability is architectural and not fixed by a simple framework upgrade; version 10.74.0 introduces a workaround to decouple token identifiers from tagged caches. Users must apply configuration changes to avoid early cache evictions and ensure token blacklists persist for their full lifespan.

Maravel PHP framework versions prior to 10.73.1 have a side-channel information disclosure vulnerability. When routes with dynamic placeholders are compiled, literal placeholder syntax can cause a 500 Internal Server Error instead of a 404 Not Found. This behavior allows an attacker to infer internal route parameter names and controller schemas by observing which inputs trigger errors. Version 10.73.1 includes a patch for this issue. A recommended workaround is to implement middleware that rejects requests containing literal brace patterns before routing.