{"id":"CVE-2026-63408","aliases":["EUVD-2026-62547","GHSA-4hpj-wmpw-ghwq"],"status":"published","title":"Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter","description":"Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content.  Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints. Request URLs consequently expose valid access tokens through Apache, proxy, and CDN logs, browser history, and Referer headers, allowing a party with access to those records to reuse the token with the owner's API privileges. This issue is fixed in version 1.0.0-rc.16.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00492,"percentile":0.42547,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-598"],"published":"2026-07-17T00:07:13.741Z","modified":"2026-10-28T02:30:57Z","products":[{"vendor":"getgrav","product":"grav-plugin-api"}],"references":[{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-4hpj-wmpw-ghwq","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/getgrav/grav-plugin-api/commit/56ae2ca3bf36c8299a4b3d376c6a20e8c0ed5ba9","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.0-rc.16","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62386.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62386","tags":["advisory"]},{"url":"https://www.vulncheck.com/advisories/grav-rc-16-authentication-bypass-via-token-url-parameter","tags":["advisory"]},{"url":"https://github.com/getgrav/grav","tags":["package"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63408.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63408","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-63408","title":"Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter","description":"Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content.  Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints. Request URLs consequently expose valid access tokens through Apache, proxy, and CDN logs, browser history, and Referer headers, allowing a party with access to those records to reuse the token with the owner's API privileges. This issue is fixed in version 1.0.0-rc.16.","status":"published","published":"2026-08-19T15:53:08.681Z","modified":"2026-08-19T18:18:38.809Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-598"],"updated_at":"2026-11-02T14:19:56.284359Z"}],"euvd":[{"id":"EUVD-2026-62547","description":"Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content.  Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints. Request URLs consequently expose valid access tokens through Apache, proxy, and CDN logs, browser history, and Referer headers, allowing a party with access to those records to reuse the token with the owner's API privileges. This issue is fixed in version 1.0.0-rc.16.","status":"published","published":"2026-08-19T15:53:08Z","modified":"2026-08-19T18:18:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:40.9092Z"}],"nvd":[{"id":"CVE-2026-63408","description":"Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content.  Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints. Request URLs consequently expose valid access tokens through Apache, proxy, and CDN logs, browser history, and Referer headers, allowing a party with access to those records to reuse the token with the owner's API privileges. This issue is fixed in version 1.0.0-rc.16.","status":"published","published":"2026-08-19T16:18:38.013Z","modified":"2026-09-09T21:13:25.91Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-598"],"updated_at":"2026-11-02T14:12:39.962615Z"}],"osv":[{"id":"CVE-2026-62386","title":"Grav \u003c 1.0.0-rc.16 Authentication Bypass via token URL Parameter","description":"The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractBearerToken fallback). Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via the Referer header, stored in browser history, and captured by upstream proxy and CDN logs, exposing valid admin access tokens. A leaked token grants unauthorized API access, including reading configuration and user data, creating admin accounts, modifying system settings, and deleting pages.","status":"published","published":"2026-07-17T00:07:13.741Z","modified":"2026-10-28T02:30:54.231598793Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-598"],"updated_at":"2026-11-02T15:45:13.306117Z"},{"id":"CVE-2026-63408","title":"Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter","description":"Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content.  Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints. Request URLs consequently expose valid access tokens through Apache, proxy, and CDN logs, browser history, and Referer headers, allowing a party with access to those records to reuse the token with the owner's API privileges. This issue is fixed in version 1.0.0-rc.16.","status":"published","published":"2026-08-19T15:53:08.681Z","modified":"2026-10-28T02:30:57.864385102Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-598"],"updated_at":"2026-11-02T15:45:13.306117Z"}]}}