CVE-2026-55250 in Maravel
Summary
by MITRE • 09/09/2026
Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. Any application with low cache memory that causes premature eviction to free up memory and applications running macropay-solutions/maravel-framework that utilize tymon/jwt-auth for API token authentication and blacklist management or any other package that does the same may be affected. This architectural risk might also impact native Laravel applications utilizing cache tags under specific volatile or eviction-capped environments. tymon/jwt-auth automatically probes for cache tag support. If found, it forcefully wraps 14-day token blacklist entries (jti) inside a relational tymon.jwt tag. In environments where the O(1) Atomic Lazy Eviction model is active — either natively inside Maravel-Framework v20.x or manually backported into v10.x via the explicit DI container singletons provided in PR #104 (App\Cache\TaggedCache and App\Cache\TagSet) — a strict global tracking ceiling (Container::TAGGED_CACHE_TTL_CAP_SECONDS) of 7,200 seconds (2 hours) is enforced to secure the system against memory index bloat. This ceiling forcefully truncates the 14-day blacklist lifespan down to a maximum of 2 hours, after which individual tracking keys naturally expire and disappear from the active cache window. Furthermore, because the optimized engine implements a generational version matrix to achieve O(1) flush speeds, any programmatic or manual invocation of a tag flush or reset (e.g., Cache::tags([...])->flush()) instantly bumps the internal atomic master version pointer. This shifts the computed cryptographic composite hash (sha1($this->tags->getNamespace())) for all overlapping components, rendering the entire existing index immediately unreachable. Consequently, through either natural 2-hour expiration or an intervening tag flush execution (like the cache naturally cleaning old values to free up memory), the invalidation state records are entirely wiped out. Because the tokens' physical cryptographic signatures remain structurally valid for up to 14 days, stolen, hijacked, or legitimately logged-out tokens are instantly and silently resurrected across the entire API gateway, leaving the application critically vulnerable to widespread Token Replay Attacks. Because this issue is caused by an upstream architectural assumption within the tymon/jwt-auth package rather than a core defect inside the framework, there is no direct framework version upgrade that can safely bypass this lifecycle collision without breaking business cache recycling bounds. Maravel version 10.74.0 introduced a way to backport the new fixed tagged cache from 20.x into 10.x by resolving TagSet and TaggedCache from DI, which is how this latent architectural lifecycle vulnerability was discovered. Users must apply the decoupled configuration workaround outlined below. As a workaround, make sure that cache memory size does not generate early natural evictions from cache to free up space, deleting blacklisted jwt ids before they expire. Applications must decouple flat authentication vectors from the relational tagging subsystem. This forces token identifiers to write directly to the primary cache keyspace as flat, un-tagged key-value pairs where they securely retain their unclipped 14-day lifecycle.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability described constitutes a critical Token Replay attack vector within applications utilizing the Maravel PHP framework and its integration with the tymon/jwt-auth package for JSON Web Token authentication. This high-severity flaw stems from an architectural mismatch between stateless token validation mechanisms and high-performance relational caching layers, specifically when tag-based cache eviction policies are employed. The core issue arises because the caching system enforces a strict global tracking ceiling of 7200 seconds, or two hours, to prevent memory index bloat in environments utilizing atomic lazy eviction models. This constraint forcibly truncates the intended fourteen-day blacklist lifespan for JWT token identifiers (jti) down to just two hours. Consequently, blacklisted tokens are prematurely removed from the active cache window either through natural expiration due to this reduced time-to-live or via programmatic tag flush operations that reset internal version pointers and invalidate all overlapping components instantly.
From a technical perspective, the vulnerability exploits the interaction between cryptographic signature validity and cache invalidation logic. While individual tracking keys for blacklisted tokens expire after two hours, the physical cryptographic signatures of those tokens remain valid for up to fourteen days as per their original configuration. This discrepancy creates a window where stolen, hijacked, or legitimately logged-out tokens are silently resurrected across the API gateway because the system no longer recognizes them as revoked. The root cause is not a defect within the Maravel framework itself but rather an upstream architectural assumption in the tymon/jwt-auth package which assumes that cache tags will persist for the full duration of the token blacklist. When applications run with low cache memory or under volatile eviction-capped environments, this assumption fails catastrophically, leading to widespread authentication bypasses where attackers can reuse previously invalidated credentials without detection.
The operational impact of this vulnerability is severe, allowing adversaries to perform Token Replay Attacks against any application relying on these specific configurations. Since the invalidation state records are entirely wiped out upon expiration or flush, there is no immediate indication that a token has been compromised or revoked by the system administrator. This affects not only applications explicitly using macropay-solutions/maravel-framework but also native Laravel applications utilizing cache tags under similar volatile conditions. The risk extends to any package implementing JWT authentication and blacklist management in environments where O(1) atomic lazy eviction is active, making it a significant threat vector for high-performance web APIs that depend on reliable session revocation mechanisms.
To mitigate this vulnerability, organizations must address the underlying architectural conflict between token lifecycle requirements and cache retention policies. The primary recommendation involves decoupling flat authentication vectors from the relational tagging subsystem to ensure token identifiers are written directly to the primary cache keyspace as untagged key-value pairs. This approach allows blacklisted JWT IDs to retain their full fourteen-day lifecycle without being subject to tag-based eviction limits or version pointer resets. Additionally, administrators should configure cache memory sizes sufficiently large to prevent early natural evictions that could delete blacklist entries before they expire. For users of Maravel framework versions prior to 10.74.0, applying the decoupled configuration workaround is essential until a proper upgrade can be performed. Upgrading to version 10.74.0 or later provides a backported fix by resolving TagSet and TaggedCache from the dependency injection container, thereby aligning cache behavior with security requirements.
This vulnerability maps directly to CWE-284 Improper Access Control, as it allows unauthorized access through the reuse of revoked credentials due to flawed state management. It also correlates with MITRE ATT&CK technique T1550 Use Alternate Authentication Credentials, specifically sub-technique T1550.003 Token Theft or Replay, where attackers leverage stolen tokens that were not properly invalidated by the application's security controls. Security teams should audit their caching configurations and JWT implementations to ensure that blacklist persistence matches token validity periods, preventing silent resurrection of revoked sessions in production environments.