https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T12:09:31.271754+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-341945 EUVD-2026-341945 2026-10-06T12:09:31.332156+00:00 EUVD-2026-341945 https://cve.radiocsirt.org/vuln/fkie_cve-2026-61452 fkie_cve-2026-61452 2026-10-06T12:09:31.332197+00:00

The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password change, new token issuance, or account disablement. An attacker who has stolen an access token retains full API access until the token naturally expires.

 https://cve.radiocsirt.org/vuln/ghsa-rrr3-rpgw-867x GHSA-rrr3-rpgw-867x 2026-10-06T12:09:31.332231+00:00

The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password change, new token issuance, or account disablement. An attacker who has stolen an access token retains full API access until the token naturally expires.