Grav API Plugin CVE-2026-63408

Exploitation requires two conditions to align: (1) the Grav API Plugin version prior to 1.0.0-rc.16 must be installed and active, and (2) the attacker must have read access to at least one of the following secondary sources that capture full request URLs - Apache/web server access logs, reverse proxy or load-balancer logs, CDN access logs, browser history on a shared machine, or Referer headers transmitted to third-party resources embedded in pages returned by the API. A valid JWT must have been issued to at least one legitimate user and used in a request that included ?token= in the URL. Exploitation is limited by the need for this log-access prerequisite - the attacker cannot directly intercept the token from the network without also being in a position to perform a man-in-the-middle attack (which HTTPS mitigates). The companion CORS wildcard issue (also fixed in rc.16) additionally requires a victim to visit a malicious cross-origin web page while authenticated, which is a separate social-engineering dependency.

The CVSS 7.5 High score (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) captures the network-reachable nature and high confidentiality impact, but the PR:N metric deserves scrutiny: exploitation requires a legitimate token that was already issued to an authenticated user, so the attacker's effort is not zero - they must first obtain access to a log source. That said, log access is realistic in shared-hosting environments, compromised infrastructure, or misconfigured CDN log exports. Impact is scoped to confidentiality (token reuse for read/write API operations), with no direct availability impact. No EPSS data was provided in the intelligence feed, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. The CORS wildcard default (also fixed in rc.16) is a compounding factor: prior to the patch, a wildcard Access-Control-Allow-Origin on authenticated responses allowed any cross-origin website to read API responses for any token it could supply - a cross-site account-takeover primitive that elevates the practical severity beyond raw token-in-log risk. Overall, this is a real, exploitable information-disclosure issue that warrants prompt patching wherever the API plugin is deployed, particularly in environments where logs are shared across tenants or forwarded to third-party SIEM/CDN services.

An attacker with read access to Apache access logs - for example, a malicious insider, a compromised log aggregation pipeline, or a co-tenant on shared hosting - scans log entries for /api/v1 requests containing ?token= query parameters. They extract a valid JWT, then replay it directly in an Authorization header against any Grav API endpoint, gaining full API access as the token's owner. No public exploit code has been identified, but the technique requires only basic HTTP tooling.