The Grav API plugin before version 2.0.4 issues JSON Web Tokens that lack a JWT ID (jti) claim, preventing server‑side revocation. Consequently, access tokens remain valid for their full lifetime—defaulting to one hour—regardless of a user’s session termination, password change, or account disabling. An attacker in possession of such a token retains uninterrupted API access until the token naturally expires.

The vulnerability affects the Grav content‑management system, specifically the getgrav/grav-plugin API component prior to version 2.0.4. Users operating the API plugin before the 2.0.4 update are vulnerable.

The CVSS score of 6.9 denotes moderate impact, while an EPSS score of less than 1 % indicates a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to possess a valid JWT, which can be obtained if the token is intercepted or if credentials are compromised; once acquired, the token can be used for continuous API access until expiration.