CVE-2026-58656: Grav API Plugin - Cross-Origin Admin Account Takeover via CORS Wildcard and JWT Query Parameter
Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: , allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website. Attackers who obtain a leaked JWT token from access logs, proxy logs, browser history, or Referrer headers can create persistent backdoor super-admin accounts and exfiltrate sensitive configuration and user data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav API pluginto a version that resolves this vulnerability.Fixed in v1.0.0-rc.16 - Configuration
Ensure the API plugin no longer returns Access-Control-Allow-Origin: *; configure CORS to restrict allowed origins instead of allowing any origin.
Grav API plugin CORS Access-Control-Allow-Origin = * (do not allow wildcard) - Configuration
Disable/stop accepting JWT tokens via the ?token= URL query parameter to prevent token leakage from access logs, proxy logs, browser history, or Referrer headers being used for admin account takeover.
Grav API plugin JWT token URL query parameter = ?token=
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58656?
The severity of CVE-2026-58656 is high with a score of 7.5.
How do I fix CVE-2026-58656?
To fix CVE-2026-58656, update the Grav API plugin to version 1.0.0-rc.16 or later.
What does CVE-2026-58656 exploit?
CVE-2026-58656 exploits the CORS configuration allowing unauthenticated attackers to take over admin accounts via JWT tokens.
What software is affected by CVE-2026-58656?
The affected software is the Grav API Plugin prior to version 1.0.0-rc.16.
What are the potential impacts of CVE-2026-58656?
The potential impacts include unauthorized cross-origin API requests that can compromise admin accounts.