CVE-2026-63407

Name of the Vulnerable Software and Affected Versions Grav API Plugin versions prior to 1.0.0-rc.16

Description The CorsMiddleware component returns an Access-Control-Allow-Origin: * header and permissive OPTIONS responses for authenticated /api/v1 endpoints. This allows JavaScript from any origin to use a stolen JSON Web Token (JWT)—a compact, URL-safe means of representing claims to be transferred between two parties—via the Authorization or X-API-Token headers. An attacker can read authenticated responses and perform write operations with the privileges of the token owner, leading to account modification and data exfiltration.

Recommendations Update Grav API Plugin to version 1.0.0-rc.16.