CVE-2026-12620 identifies an information exposure vulnerability in Microchip GridTime 3000 GNSS Time Server. The vulnerability involves leaking access tokens via URL parameters on certain endpoints, potentially exposing sensitive authentication tokens to unauthorized parties. The affected versions include 1.0r0.03 through 1.1r0.0. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, user interaction needed, low confidentiality impact, and no impact on integrity or availability. No vendor advisory or patch information is currently provided.

Exposure of access tokens in URL parameters can lead to unauthorized access if tokens are intercepted by network observers or logged in browser histories or intermediary systems. The confidentiality impact is rated low, and no direct integrity or availability impacts are reported. The medium severity reflects the potential for token leakage but limited scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit exposure by restricting access to affected endpoints, using secure channels (e.g., HTTPS), and avoiding sharing URLs containing tokens. Monitor for vendor updates regarding official fixes.