JWT token exposure in URL parameters in Grav API plugin (CVE-2026-62386)

The Grav API plugin (getgrav/grav-plugin-api) accepts JWT access tokens via the `?token=` URL query parameter across all API routes, causing tokens to be recorded verbatim in web server access logs, leaked through the Referer header, stored in browser history, and captured by upstream proxy and CDN logs. A leaked token grants unauthorized API access including reading configuration and user data, creating admin accounts, modifying system settings, and deleting pages. Affected versions: - <= v1.0.0-rc.15 We recommend updating to: 1.0.0-rc.16. CVSS 8.2 · our assessment: this_week Vendor advisory: https://github.com/getgrav/grav/security/advisories/GHSA-4hpj-wmpw-ghwq Details: https://vuln.today/cve/CVE-2026-62386