Executive brief
Grav's API plugin, which provides headless access to website content, accepts authentication tokens through URL query parameters on state-changing requests. This causes valid access tokens to be exposed in server logs, proxy records, browser history, and referrer headers, allowing attackers with access to these records to impersonate legitimate users and make authenticated API requests with the owner's privileges.
Technical details
The vulnerability exists in the JwtAuthenticator::extractBearerToken() method, which accepts JWT tokens from the ?token= URL query parameter on all /api/v1 routes, including state-changing (POST/PUT/DELETE) endpoints. This design flaw causes access tokens to be logged in plaintext across HTTP infrastructure (Apache logs, CDN logs, reverse proxies) and client systems (browser history, referrer headers), violating the security principle of keeping credentials out of URLs. An attacker who gains access to these logs (e.g., via compromised server, exposed CDN logs, or network interception) can extract and reuse tokens to make authenticated API calls. The fix, released in version 1.0.0-rc.16, restricts the ?token= query parameter to safe (GET/HEAD) requests on file-streaming routes only, while all JSON API routes and state-changing methods now ignore it.
Affected products
- Grav API Plugin prior to 1.0.0-rc.16
Timeline
- 2026-08-19: disclosed
- 2026-06-19: patched: Fix released in version 1.0.0-rc.16