Description

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints. Request URLs consequently expose valid access tokens through Apache, proxy, and CDN logs, browser history, and Referer headers, allowing a party with access to those records to reuse the token with the owner's API privileges. This issue is fixed in version 1.0.0-rc.16.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-19T16:18:38.013Z",
  "pubdate": "2026-08-19T16:18:38.013Z",
  "executiveSummary": "The Grav API Plugin for Grav CMS contains an information exposure vulnerability affecting versions prior to 1.0.0-rc.16.\nThe vulnerability stems from the JwtAuthenticator::extractBearerToken() function, which accepts JSON Web Tokens (JWT) passed via the token URL query parameter across all /api/v1 routes, including state-changing endpoints.\nThis design flaw leads to the leakage of valid access tokens through multiple vectors, such as Apache web server logs, intermediary proxies, Content Delivery Network (CDN) logs, browser history, and HTTP Referer headers.\nAn external attacker or unauthorized party with access to any of these logging or history records can capture the exposed bearer token and replay it to authenticate against the RESTful API with the victim's exact privileges.\nThe impact includes unauthorized access to headless site content and potential manipulation of state-changing operations.\nExploitation requires the target user to issue requests containing the token in the query string while an observer or logging mechanism captures the URL parameters.\nRisk implications are high for environments where access logs are broadly accessible or where strict transport security and log scrubbing are not enforced.",
  "technicalDetails": "The vulnerability resides within the Grav API Plugin, specifically inside the JwtAuthenticator::extractBearerToken() implementation.\nDuring the processing of incoming HTTP requests on any /api/v1 route, the authentication component checks for a JSON Web Token (JWT) supplied via the token URL query parameter.\nThe root cause is the reliance on query string parameters for sensitive bearer token transmission.\nBecause URLs and their query parameters are frequently recorded by standard web server logging architectures (such as Apache access logs), intermediary HTTP proxies, and CDNs, the secret token is persistently stored in plaintext outside the application boundary.\nFurthermore, when authenticated users navigate away from the site or load external resources, browsers may leak the full URL including the token via the HTTP Referer header, and the complete URI remains stored within local browser history.\nThe step-by-step attack flow proceeds as follows: First, a legitimate user initiates an API request to a state-changing or data-retrieval endpoint under /api/v1 while appending their JWT via the token query parameter. Second, network infrastructure components, proxy layers, or browser artifacts capture the complete request URL containing the sensitive token. Third, an unauthorized third party with administrative access to log files, proxy caches, or compromised browser storage extracts the plaintext JWT. Fourth, the attacker crafts subsequent API requests utilizing the stolen bearer token.\nThe vulnerable component is the JwtAuthenticator class handling token extraction.\nAll versions of the Grav API plugin prior to 1.0.0-rc.16 are affected.\nThe vulnerability is exposed across the entire network boundary where /api/v1 routes are accessible over HTTP/HTTPS.\nPost-exploitation impact allows the attacker to impersonate the token owner, granting full headless access to site content and execution capabilities equivalent to the victim's API privileges."
}