CVE-2026-62386

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.0-rc.16

Description The plugin accepts JWT (JSON Web Token) access tokens via the token URL query parameter on every API route through the JwtAuthenticator::extractBearerToken fallback. This behavior causes tokens to be logged in web server access logs, leaked via the Referer header, stored in browser history, and captured by upstream proxy and CDN logs. An attacker with access to a leaked token can gain unauthorized API access to read configuration and user data, create admin accounts, modify system settings, and delete pages.

Recommendations Update the Grav API plugin to version 1.0.0-rc.16 or later.