Threat Intelligence Database

CVE-2026-55250 is a high-severity token replay vulnerability in macropay-solutions maravel-framework versions prior to 10.74.0. The issue arises from a lifecycle mismatch between stateless token validation and a caching layer that truncates token blacklist lifespans from 14 days to 2 hours. This allows blacklisted tokens to be accepted after cache eviction or flush, enabling token replay attacks. The vulnerability is due to architectural assumptions in the tymon/jwt-auth package used for API token authentication. Maravel 10.74.0 introduced a partial fix by backporting a new tagged cache implementation, but no direct patch fully resolves the issue without configuration changes. Users must apply a workaround to decouple token identifiers from the tagging cache to preserve the full blacklist lifespan.

Maravel framework versions prior to 10.73.1 have a side-channel information disclosure vulnerability. The issue occurs when routes with dynamic placeholders are compiled, causing literal placeholder keys to be registered incorrectly. This leads to a 500 Internal Server Error when an attacker sends requests with literal template syntax, revealing internal route parameter names via error responses. Version 10.73.1 includes a patch for this issue. A recommended workaround is to implement middleware that rejects requests containing literal brace patterns before routing.