The Grav API plugin prior to version 1.0.0-rc.16 has a vulnerability where it accepts JWT tokens through the GET request query string parameter 'token' and responds with a permissive CORS header (Access-Control-Allow-Origin: *). This allows unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website if they can obtain a JWT token leaked in access logs, proxy logs, browser history, or Referrer headers. Exploitation can lead to creation of persistent backdoor super-admin accounts and exfiltration of sensitive configuration and user data.

An attacker who obtains a leaked JWT token can bypass authentication and perform privileged actions on the Grav API, including creating super-admin accounts and accessing sensitive configuration and user data. The vulnerability enables cross-origin requests from any origin due to the permissive CORS policy, increasing the risk of token theft and unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid exposing JWT tokens in URL query parameters and monitor for vendor updates addressing this vulnerability. Until an official fix is available, consider restricting CORS policies and reviewing access logs for token leakage.