CVE-2026-63408
Received Received - Intake

JWT Token Exposure in Grav API Plugin

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints. Request URLs consequently expose valid access tokens through Apache, proxy, and CDN logs, browser history, and Referer headers, allowing a party with access to those records to reuse the token with the owner's API privileges. This issue is fixed in version 1.0.0-rc.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-63408
EUVD
EUVD-2026-62547

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
getgrav grav_api_plugin to 1.0.0-rc.16 (inc)
grav api_plugin to 1.0.0-rc.16 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-598 The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Grav API Plugin before version 1.0.0-rc.16 has a vulnerability where the JwtAuthenticator::extractBearerToken() function accepts JWT tokens from the URL query parameter on all API routes, including state-changing endpoints. This causes tokens to be exposed in logs, browser history, and Referer headers, allowing attackers with access to these records to reuse the tokens and gain API privileges.

Detection Guidance

Check Grav API plugin version for versions prior to 1.0.0-rc.16. Inspect web server logs for URLs containing ?token= parameters on /api/v1 routes. Monitor browser history and Referer headers for exposed tokens. Use network traffic analysis tools to detect JWT tokens in query strings.

Impact Analysis

Attackers can capture exposed tokens from logs, browser history, or Referer headers and reuse them to perform unauthorized actions such as reading admin profiles, modifying configurations, creating admin accounts, or deleting pages. This could lead to full administrative account takeover if combined with other vulnerabilities.

Compliance Impact

This vulnerability may violate compliance requirements such as GDPR and HIPAA by exposing sensitive authentication tokens through logs and intermediate systems. Unauthorized access to user data or system configurations could result in data breaches, leading to legal penalties and reputational damage.

Mitigation Strategies

Upgrade Grav API plugin to version 1.0.0-rc.16 or later. Remove all JWT tokens from URLs and use only Authorization headers. Review and restrict CORS configurations to allowlisted domains. Rotate all exposed tokens immediately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63408. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart