CVE-2026-12620 describes an information exposure vulnerability (CWE-200) in Microchip GridTime 3000 GNSS Time Server. The affected versions, including 1.0r0.03, leak access tokens in URL parameters on certain endpoints, potentially allowing unauthorized parties to capture sensitive tokens if URLs are logged or intercepted. The vulnerability has a CVSS 4.6 (medium) rating, indicating a moderate risk. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Exposure of access tokens in URL parameters can lead to unauthorized access if these tokens are intercepted through logs, browser history, or network monitoring. This may compromise the security of the affected system by allowing attackers to impersonate authorized users or services. However, the vulnerability does not directly allow remote code execution or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid exposing URLs containing access tokens in logs or shared environments. Limit access to network traffic and logs that may contain such URLs to trusted personnel only.