Search/CVE-2026-55250
● CVE

CVE-2026-55250

DiscoveredSep 8, 2026UpdatedSep 10, 2026

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. Any application with low cache memory that causes premature eviction to free up memory and applications running macropay-solutions/maravel-framework that utilize tymon/jwt-auth for API token authentication and blacklist management or any other package that does the same may be affected. This architectural risk might also impact native Laravel applications utilizing cache tags under specific volatile or eviction-capped environments. tymon/jwt-auth automatically probes for cache tag support. If found, it forcefully wraps…

CVSS v3.1
—
EPSS
0.87%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Sep 10, 2026 → Sep 25, 2026
▲ 0.32pp
0.55% → 0.87% over 2 tracked changes
Connections
3 relationships
Timeline
disclosure → media coverage
Sep 8, 2026
Disclosure — published as a CVE record.