CVE-2026-62386 Details
Description
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractBearerToken fallback). Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via the Referer header, stored in browser history, and captured by upstream proxy and CDN logs, exposing valid admin access tokens. A leaked token grants unauthorized API access, including reading configuration and user data, creating admin accounts, modifying system settings, and deleting pages.
A vulnerability exists in the Grav API plugin (getgrav/grav-plugin-api) in versions prior to 1.0.0-rc.16. The plugin improperly accepts JWT access tokens via the ?token= URL query parameter on all API routes. This implementation, which serves as a fallback for the JwtAuthenticator's extractBearerToken method, exposes tokens by embedding them in URLs. Such exposure leads to tokens being logged in web server access logs, leaked through the Referer header, stored in browser history, and captured by upstream proxy and CDN logs. The leakage of these tokens exposes valid admin access tokens, allowing unauthorized API access. This includes reading configuration and user data, creating admin accounts, modifying system settings, and deleting pages.
Users can update to Grav API Plugin version 1.0.0-rc.16 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-4hpj-wmpw-ghwq | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/getgrav/grav/security/advisories/GHSA-4hpj-wmpw-ghwq | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/grav-rc-16-authentication-bypass-via-token-url-parameter | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-598 | Use of GET Request Method With Sensitive Query Strings | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav API | <= 1.0.0-rc.15 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |