CVE-2026-62386
HIGH
CVSS 8.2
grav
Verified Advisory
JWT token exposure in URL parameters in Grav API plugin (CVE-2026-62386)
The Grav API plugin (getgrav/grav-plugin-api) accepts JWT access tokens via the `?token=` URL query parameter across all API routes, causing tokens to be recorded verbatim in web server access logs, leaked through the Referer header, stored in browser history, and captured by upstream proxy and CDN logs. A leaked token grants unauthorized API access including reading configuration and user data, creating admin accounts, modifying system settings, and deleting pages.
Affected versions:
- <= v1.0.0-rc.15
We recommend updating to: 1.0.0-rc.16.
CVSS 8.2 · our assessment: this_week
Vendor advisory: https://github.com/getgrav/grav/security/advisories/GHSA-4hpj-wmpw-ghwq
Details: https://vuln.today/cve/CVE-2026-62386
Verified by vuln.today against published advisories.
Affected versions
- – <= v1.0.0-rc.15
Fixed in: 1.0.0-rc.16
More advisories for grav
- CVE-2026-65608 – Remote code execution in Grav CMS via unchecked callable in FlexDirectory (CVE-2026-65608)
- CVE-2026-65895 – Broken access control in Grav API Plugin configuration scopes (CVE-2026-65895)
- CVE-2026-65896 – Path traversal in Grav API Plugin POST /pages/{route}/move endpoint (CVE-2026-65896)
- CVE-2026-65897 – Privilege escalation via unvalidated groups field in Grav API Plugin (CVE-2026-65897)
- CVE-2026-65603 – Privilege Escalation via profile self-update in Grav Login plugin (CVE-2026-65603)
- CVE-2026-65008 – Remote code execution via unrestricted callable in Grav CMS (CVE-2026-65008)
- CVE-2026-65007 – Missing authorization on API key generation in Grav API plugin (CVE-2026-65007)
- CVE-2026-62230 – Case-sensitive extension filtering bypass in Grav CMS (CVE-2026-62230)