Quick answers
- Is CVE-2026-63408 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-63408 being exploited in the wild.
- How severe is CVE-2026-63408?
- High severity, with a CVSS score of 7.5, published 19 August 2026.
- Which products and versions are affected?
- Grav API Plugin prior to 1.0.0-rc.16.
- Is there a fix for CVE-2026-63408?
- A patch was published on 2026-06-19: Fix released in version 1.0.0-rc.16 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-63408 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-63408?
- Check whether you run Grav API Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the JwtAuthenticator::extractBearerToken() method, which accepts JWT tokens from the ?token= URL query parameter on all /api/v1 routes, including state-changing (POST/PUT/DELETE) endpoints. This design flaw causes access tokens to be logged in plaintext across HTTP infrastructure (Apache logs, CDN logs, reverse proxies) and client systems (browser history, referrer headers), violating the security principle of keeping credentials out of URLs. An attacker who gains access to these logs (e.g., via compromised server, exposed CDN logs, or network interception) can extract and reuse tokens to make authenticated API calls. The fix, released in version 1.0.0-rc.16, restricts the ?token= query parameter to safe (GET/HEAD) requests on file-streaming routes only, while all JSON API routes and state-changing methods now ignore it.
Affected products
- Grav API Plugin prior to 1.0.0-rc.16
Timeline
- 2026-08-19: disclosed
- 2026-06-19: patched: Fix released in version 1.0.0-rc.16