CVE-2026-63408: Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints. Request URLs consequently expose valid access tokens through Apache, proxy, and CDN logs, browser history, and Referer headers, allowing a party with access to those records to reuse the token with the owner's API privileges. This issue is fixed in version 1.0.0-rc.16.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav API Pluginto a version that resolves this vulnerability.Fixed in 1.0.0-rc.16
Event History
Frequently Asked Questions
Who is exposed to token leakage from this issue?
Any deployment using a Grav API Plugin version prior to 1.0.0-rc.16 is affected when JWTs are supplied in the token URL query parameter on /api/v1 routes. Tokens in request URLs can be recorded by Apache, proxies, CDNs, browser history, and Referer headers.
What does an attacker need to exploit the issue?
An attacker needs access to a logged, stored, or forwarded URL containing a valid JWT passed through the token query parameter. They can then reuse that token with the privileges of its owner.
Are state-changing API operations affected?
Yes. Prior to the fixed version, the plugin accepts query-parameter JWTs on every /api/v1 route, including state-changing endpoints.
What should be done if the plugin cannot be upgraded immediately?
Avoid placing JWTs in the token URL query parameter and prevent URLs containing tokens from being logged, retained, or forwarded where possible. Existing tokens exposed in URLs should be treated as reusable by anyone who can access those records.
How can I determine whether my deployment is affected?
Check whether the Grav API Plugin version is earlier than 1.0.0-rc.16 and review API, web-server, proxy, CDN, and browser-related records for /api/v1 URLs containing a token query parameter.