CVE-2026-55250 - Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Tagged Caches
Brief
CVE ID : CVE-2026-55250
Published : Sept. 8, 2026, 11:17 p. m.
- 1 hour, 33 minutes ago
Description : Maravel, a PHP framework oriented towards dependency injection, prior to version 10.
- 0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers.
Any application with low cache memory that causes premature eviction to free up memory and applications running macropay-solutions/maravel-framework that utilize tymon/jwt-auth for API token authentication and blacklist management or any other package that does the same may be affected.
This architectural risk might also impact native Laravel applications utilizing cache tags under specific volatile or eviction-capped environments. tymon/jwt-auth automatically probes for cache tag support.