CVE-2026-62386CWE-598

Grav < 1.0.0-rc.16 Authentication Bypass via token URL Parameter

High · published July 17, 2026

CVSS v4.0
8.2
EPSS
0%
Percentile
36.5
In the wild
Unconfirmed
What it is

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractBearerToken fallback). Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via the Referer header, stored in browser history, and captured by upstream proxy and CDN logs, exposing valid admin access tokens. A leaked token grants unauthorized API access, including reading configuration and user data, creating admin accounts, modifying system settings, and deleting pages.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00432 · 36.5th percentile
Weakness
CWE-598 · Use of HTTP Request With Sensitive Query String
Published
2026-07-17T00:07Z
EPSS history
Timeline
  • 17 JUL 00:07Z
    Grav < 1.0.0-rc.16 Authentication Bypass via token URL Parameter
    cvelistv5