CVE-2026-62386
HIGHGrav < 1.0.0-rc.16 Authentication Bypass via token URL Parameter
Title source: cnaDescription
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractBearerToken fallback). Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via the Referer header, stored in browser history, and captured by upstream proxy and CDN logs, exposing valid admin access tokens. A leaked token grants unauthorized API access, including reading configuration and user data, creating admin accounts, modifying system settings, and deleting pages.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-4hpj-wmpw-ghwq)
https://github.com/getgrav/grav/security/advisories/GHSA-4hpj-wmpw-ghwq
Third Party Advisory third-party-advisory
VulnCheck Advisory: Grav < 1.0.0-rc.16 Authentication Bypass via token URL Parameter
https://www.vulncheck.com/advisories/grav-rc-16-authentication-bypass-via-token-url-parameter
Scores
CVSS v3
7.5
EPSS
0.0027
EPSS Percentile
18.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-598
Status
published
Products (2)
getgrav/grav
< 1.0.0-rc.16
getgrav/grav
1.0.0-rc.16
Published
Jul 17, 2026
Tracked Since
Jul 17, 2026