Grav API Plugin JWT Token Authentication Bypass

Compliance Impact

This vulnerability allows attackers to create persistent super-admin backdoor accounts and exfiltrate sensitive configuration and user data by exploiting leaked JWT tokens and permissive CORS policies.

Such unauthorized access and data exfiltration can lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive data.

The exposure of sensitive user data and configuration information due to this vulnerability could result in non-compliance with these standards, potentially leading to legal and financial consequences.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-58656 is a high-severity vulnerability in the Grav CMS API plugin versions before v1.0.0-rc.16. The plugin accepts JWT tokens via the URL query parameter (?token=) and responds with a permissive CORS header (Access-Control-Allow-Origin: *). This combination allows unauthenticated attackers to perform fully authenticated cross-origin API requests from any malicious website.

Attackers who obtain leaked JWT tokens from sources like access logs, proxy logs, browser history, or Referrer headers can exploit this flaw to create persistent super-admin backdoor accounts and exfiltrate sensitive configuration and user data.

The root cause is insecure token handling in the JwtAuthenticator.php file and overly permissive CORS headers that allow cross-origin responses to be read by any website.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized creation of persistent super-admin backdoor accounts, which grants attackers full administrative control over the Grav CMS instance.

Attackers can exfiltrate sensitive configuration and user data without needing direct server access.

Because the vulnerability allows fully authenticated cross-origin API requests from any malicious website, it significantly increases the attack surface and risk of data breaches.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying the presence of JWT tokens passed via the ?token= URL query parameter and checking for the Access-Control-Allow-Origin header set to * in API responses.

You can inspect network traffic or logs for URLs containing the ?token= parameter to find potential token leakage.

Additionally, checking HTTP response headers for Access-Control-Allow-Origin: * can help confirm the permissive CORS policy.

• Use curl to check CORS headers: curl -I https://your-grav-site/api/endpoint
• Search web server or proxy logs for URLs containing ?token= to detect leaked JWT tokens.
• Use network monitoring tools (e.g., Wireshark or tcpdump) to capture and analyze HTTP requests with JWT tokens in query parameters.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading the Grav API plugin to version 1.0.0-rc.16 or later, where this vulnerability is fixed.

If upgrading is not immediately possible, restrict or disable the acceptance of JWT tokens via the URL query parameter (?token=) to prevent token leakage.

Also, configure the server to avoid setting Access-Control-Allow-Origin to *, instead specify trusted origins to limit cross-origin requests.

Review and rotate any potentially leaked JWT tokens to invalidate compromised credentials.

Useful 0 Not Useful 0