CVE-2026-63408

Name of the Vulnerable Software and Affected Versions Grav API Plugin versions prior to 1.0.0-rc.16

Description The JwtAuthenticator::extractBearerToken() function accepts a JSON Web Token (JWT) via a URL query parameter on all /api/v1 endpoints, including those that change state. This behavior causes valid access tokens to be exposed in browser history, Referer headers, and logs from CDNs, proxies, and Apache servers, enabling an attacker with access to these logs to reuse the token and gain the API privileges of the token owner.

Recommendations Update Grav API Plugin to version 1.0.0-rc.16.