Search

CVE-2026-55250 - Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Tagged Caches

CVE ID : CVE-2026-55250 Published : Sept. 8, 2026, 11:17 p. m. • 1 hour, 33 minutes ago Description : Maravel, a PHP framework oriented towards dependency injection, prior to version 10. 74. 0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. Any application with low cache memory that causes premature eviction to free up memory and applications running macropay-solutions/maravel-framework that utilize tymon/jwt-auth for API token authentication and blacklist management or any other package that does the same may be affected. This architectural risk might also impact native Laravel applications utilizing cache tags under specific volatile or eviction-capped environments. tymon/jwt-auth automatically probes for cache tag support.