CVE-2026-62386 describes a vulnerability in the Grav API plugin before version 1.0.0-rc.16 where JWT access tokens are accepted through the ?token= URL query parameter on every API route. Because tokens are embedded in URLs, they are exposed in multiple locations including web server access logs, Referer headers, browser history, and upstream proxy or CDN logs. This exposure can lead to leakage of valid admin access tokens. Possession of such a token allows unauthorized API access with high privileges, including reading sensitive data, creating admin accounts, changing system settings, and deleting content.

The vulnerability allows attackers who obtain leaked JWT tokens to gain unauthorized administrative access to the Grav API. This includes the ability to read configuration and user data, create new admin accounts, modify system settings, and delete pages. The exposure of tokens in logs and headers significantly increases the risk of token theft and subsequent compromise of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid passing JWT tokens via URL query parameters. Use alternative methods such as Authorization headers to transmit tokens securely. Review and restrict access to logs and proxies that may capture sensitive URL data to minimize token exposure.