Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractBearerToken fallback). Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via the Referer header, stored in browser history, and captured by upstream proxy and CDN logs, exposing valid admin access tokens. A leaked token grants unauthorized API access, including reading configuration and user data, creating admin accounts, modifying system settings, and deleting pages.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-62386 JWT Access Token Exposure in Grav API Plugin Before 1.0.0-rc.16 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-62386
Post summary
The CVE report identifies a JWT access token exposure flaw in Grav API Plugin prior to version 1.0.0-rc.16, but provides no PoC, exploit, active usage, or patch details.
Grav API plugin: CVE-2026-62386 και διαρροή JWT tokens μέσω URL https://secn.ws/WKq6Qx
Post summary
The snippet announces the newly identified CVE-2026-62386 affecting the Grav API plugin, highlighting JWT token leakage via URL, but does not provide any PoC, exploit, or mitigation details.