JWT Vulnerability in Grav API Plugin for Grav CMS

CVE-2026-63408

What is CVE-2026-63408?

The Grav API Plugin for Grav CMS contains a vulnerability within the JwtAuthenticator::extractBearerToken() function that improperly processes JWTs from the token URL query parameter on every /api/v1 route, including those that modify state. This oversight can lead to the exposure of valid access tokens in Apache, proxy, and CDN logs, browser history, and Referer headers. Attackers with access to these records would be able to reuse the exposed tokens, potentially gaining unauthorized access to the owner's API privileges. The issue has been addressed in version 1.0.0-rc.16, and all users are advised to update their installations to mitigate potential risks.

References