CVE-2026-62386 affects the Grav API plugin prior to version 1.0.0-rc.16 by accepting JWT tokens through the ?token= query parameter on every API route. Embedding tokens in URLs leads to their exposure in various logs and browser artifacts, which can be exploited to gain unauthorized administrative API access. This includes the ability to read configuration and user data, create admin accounts, modify system settings, and delete pages. The vulnerability has a CVSS 4.0 score of 8.2 (high severity). No vendor advisory or patch information is available at this time.

Exposure of JWT tokens in URLs results in their logging and leakage through multiple vectors such as web server access logs, Referer headers, browser history, and upstream proxy/CDN logs. An attacker obtaining a leaked token can perform unauthorized API actions with administrative privileges, including data disclosure, account creation, configuration changes, and content deletion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using the ?token= query parameter to transmit JWT tokens. Prefer authorization headers or other secure token transmission methods to prevent token leakage via URLs.