Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Grav API Plugin - Unsecured JWT Tokens Allow Cross-Site Attacks

CVE-2026-58656 · published 3 months ago
Summary

The Grav API plugin, used with Grav websites, allows attackers to access sensitive data if they obtain a leaked authentication token. This can happen if the token is shared through website logs or user history. To protect your site, update the Grav API plugin to the latest version.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
getgrav grav <= 1.0.0-rc.15
Original advisory text
Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: *, allowing unauthenticated attackers to make fully authent...
Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: *, allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website. Attackers who obtain a leaked JWT token from access logs, proxy logs, browser history, or Referrer headers can create persistent backdoor super-admin accounts and exfiltrate sensitive configuration and user data.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-598Use of HTTP Request With Sensitive Query String
Timeline
Published8 Jul 2026
Updated3 Nov 2026
First seen8 Jul 2026
Sources
CVE-2026-58656 · NVD
CVE-2026-58656 · MITRE
Track software like this
Free during beta