CVE-2026-62386: Grav API Plugin Token Exposure Vulnerability

CVE-2026-62386 Overview

CVE-2026-62386 affects the Grav API plugin (getgrav/grav-plugin-api) in versions before 1.0.0-rc.16. The plugin accepts JSON Web Token (JWT) access tokens via the ?token= URL query parameter on every API route through the JwtAuthenticator::extractBearerToken fallback. Tokens embedded in URLs leak through multiple channels including web server access logs, HTTP Referer headers, browser history, and upstream proxy or content delivery network (CDN) logs. A leaked administrator token grants unauthorized API access, enabling attackers to read configuration and user data, create administrator accounts, modify system settings, and delete pages.

Critical Impact
Exposed admin JWTs allow full API takeover including account creation, configuration reads, and page deletion.

Affected Products

Grav CMS with the getgrav/grav-plugin-api plugin installed
Grav API plugin versions prior to 1.0.0-rc.16
Deployments where API traffic traverses logging proxies, CDNs, or shared browsers

Discovery Timeline

2026-07-17 - CVE-2026-62386 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-62386

Vulnerability Analysis

The root defect is an information exposure through sent data flaw classified as [CWE-598]. The JwtAuthenticator component in the Grav API plugin supports two mechanisms for supplying a bearer token. The primary mechanism is the standard HTTP Authorization: Bearer <token> header. The fallback mechanism extracts the token from the ?token= URL query parameter on any API route.

URL query parameters are not treated as sensitive material by intermediate systems. Web servers write full request URIs to access logs. Browsers store URLs in history and transmit them via the Referer header when users navigate to external resources. Reverse proxies, load balancers, and CDN edge nodes routinely log query strings for analytics and debugging. Any of these locations become secondary stores of live administrator credentials.

Because the exposed material is a valid JWT, no additional authentication is required to reuse it. An attacker who obtains a log line, a shared browser history entry, or a captured Referer value can replay the token against the API until it expires. The token carries administrator scope where applicable, so replay grants the same authority as an authenticated session operator.

Root Cause

The plugin trusts a low-integrity input channel (URL query string) for high-value authentication material. Sensitive credentials should be transmitted only in request headers or request bodies that are not routinely persisted by logging infrastructure.

Attack Vector

Exploitation is network-based and requires no privileges or user interaction. An attacker with read access to any downstream log source, browser history, or Referer-captured URL can extract the token and issue authenticated API calls to endpoints that create administrator accounts, alter site configuration, or delete content.

No verified proof-of-concept code is published. See the GitHub Security Advisory and the VulnCheck Advisory on Grav Authentication Bypass for vendor detail.

Detection Methods for CVE-2026-62386

Indicators of Compromise

Access log entries containing ?token= or &token= parameters on Grav API routes
Unexpected creation of administrator accounts or role changes in Grav user configuration
API requests originating from IP addresses that do not match known administrator sources
Referer header values in downstream services containing Grav API URLs with embedded tokens

Detection Strategies

Grep web server, reverse proxy, and CDN logs for token= query parameters on any Grav API path
Review Grav admin audit trails for account creation, permission modification, and page deletion events
Correlate API authentication events against expected administrator source IP ranges and user agents
Inspect browser history exports and CI/CD logs for URLs containing embedded JWTs

Monitoring Recommendations

Alert on any HTTP request to Grav API endpoints containing a token query parameter
Monitor for new administrator account creation events outside of change windows
Track outbound requests that carry Referer headers containing Grav API paths
Retain and centralize proxy and CDN access logs to support forensic review of token exposure scope

How to Mitigate CVE-2026-62386

Immediate Actions Required

Upgrade the Grav API plugin to version 1.0.0-rc.16 or later
Rotate all issued JWT signing keys and invalidate outstanding tokens after upgrade
Audit web server, proxy, and CDN logs for historical token= query values and treat any discovered tokens as compromised
Review Grav user and configuration data for unauthorized administrator accounts or modifications

Patch Information

The maintainer resolved the issue in getgrav/grav-plugin-api version 1.0.0-rc.16 by removing the URL query parameter fallback in JwtAuthenticator::extractBearerToken. Refer to the GitHub Security Advisory for the fixed release.

Workarounds

Block requests containing a token query parameter to Grav API routes at the reverse proxy or web application firewall
Restrict Grav admin API endpoints to known administrator source IP addresses until patched
Purge historical access logs, proxy logs, and CDN logs that may contain leaked tokens after rotation
Shorten JWT lifetimes to reduce the replay window for any token that has already leaked

bash

# Example NGINX rule to reject token query parameters on Grav API routes
location ~ ^/api/ {
    if ($arg_token) {
        return 400;
    }
    proxy_pass http://grav_backend;
}