CVE-2026-63407
Received Received - Intake

Authentication Bypass in Grav API Plugin

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin CorsMiddleware returns Access-Control-Allow-Origin: * and permissive OPTIONS responses for authenticated /api/v1 endpoints. JavaScript from any origin can submit an attacker-obtained JWT through the Authorization or X-API-Token header, read the authenticated response, and perform write operations with the token owner's privileges, enabling data exfiltration and account modification. This issue is fixed in version 1.0.0-rc.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-63407
EUVD
EUVD-2026-62545

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
getgrav grav_api_plugin to 1.0.0-rc.16 (exc)
getgrav grav_api_plugin to 1.0.0-rc.15 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-942 The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Grav API Plugin for Grav CMS. Before version 1.0.0-rc.16, the plugin incorrectly allowed any website to access authenticated API endpoints via permissive CORS settings. Attackers could use a stolen JWT token to make cross-origin requests, potentially taking over user accounts or exfiltrating data.

Detection Guidance

Check Grav API plugin version with: grep -r "grav-plugin-api" /path/to/grav/install. If version is <= 1.0.0-rc.15, the system is vulnerable. Inspect CORS headers in API responses using curl -I -H "Origin: http://attacker.com" https://your-grav-site.com/api/v1/users. If Access-Control-Allow-Origin: * appears for authenticated endpoints, the vulnerability exists.

Impact Analysis

If you use the Grav API Plugin before version 1.0.0-rc.16, an attacker could steal your JWT token and perform actions on your behalf, such as modifying data or accessing sensitive information. This could lead to unauthorized account access or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using affected versions may face compliance violations and potential fines.

Mitigation Strategies

Upgrade Grav API plugin to version 1.0.0-rc.16 or later immediately. Review and restrict CORS settings to allow only trusted domains. Remove JWT tokens from URL query parameters for sensitive API operations. Monitor logs for unauthorized cross-origin requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63407. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart