Token Replay Vulnerability in Maravel PHP Framework Affects Multiple Applications

CVE-2026-55250

What is CVE-2026-55250?

The Maravel PHP framework, prior to version 10.74.0, is vulnerable to a Token Replay Vulnerability caused by a lifecycle mismatch between token validation mechanisms and caching layers. This issue primarily affects applications utilizing the tymon/jwt-auth package for API authentication. In scenarios where cache memory is constrained, older tokens can be resurrected after their intended expiry due to premature cache eviction. This occurs because the caching mechanism's architecture inadvertently allows expired tokens to remain valid within the system, rendering applications susceptible to Token Replay Attacks. Furthermore, the vulnerability stems from an architectural assumption within the tymon/jwt-auth package rather than a core defect in the Maravel framework. Users are advised to apply specific workarounds to secure their applications against potential exploitation, including managing cache sizes effectively and separating authentication vectors from relational tagging mechanisms.

References