CVE-2026-58656

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.0-rc.16

Description The plugin accepts JSON Web Tokens (JWT) through the token URL query parameter and returns an Access-Control-Allow-Origin: * header. This configuration allows unauthenticated attackers to perform fully authenticated cross-origin API requests from malicious websites. If a JWT token is leaked via access logs, proxy logs, browser history, or Referrer headers, an attacker can exfiltrate sensitive user and configuration data or create persistent super-admin backdoor accounts.

Recommendations Update Grav API plugin to version 1.0.0-rc.16 or later.