CVE-2026-58656 Grav API Plugin: JWT Authentication Bypass & CORS Misconfiguration

Technical summary

CVE-2026-58656 exploits a multi-layer authentication and access-control flaw in the Grav API plugin. The vulnerability stems from the plugin accepting JWT tokens via the ?token= URL query parameter, a pattern vulnerable to token leakage through Referer headers, browser history, and server access logs. The plugin simultaneously responds with Access-Control-Allow-Origin: *, which removes cross-origin restrictions entirely. An attacker who obtains a valid JWT token can craft a malicious webpage that, when visited by any user, silently makes fully authenticated API calls to the Grav installation. The attacker can then provision new super-admin accounts and read configuration files and user records. The vulnerability is classified under CWE-598 (Use of GET Request with Sensitive Query Strings), highlighting the architectural mistake of treating query parameters as secure credential containers.

Business impact

Compromise of a Grav instance via this vulnerability results in administrative account takeover, allowing attackers to modify website content, inject malware, harvest user and site configuration data, and establish persistent backdoor access. Organizations relying on Grav for content management face potential data exfiltration, brand damage, and operational disruption. The risk is heightened because JWT tokens may already be present in access logs or proxy records within the organization, making exploitation possible without external attack infrastructure.

Affected systems

Grav API plugin versions prior to 1.0.0-rc.16 are vulnerable. Organizations running Grav CMS with the API plugin enabled should immediately verify their installed version and apply the available patch. Confirm patch version eligibility against the vendor advisory.

Exploitability

Exploitability is high under realistic conditions. The vulnerability requires only network access to a Grav instance and possession of a valid JWT token—a low bar given how frequently tokens leak into logs and browser history. No user interaction is needed beyond a victim visiting an attacker-controlled website. However, the initial token acquisition step may require some reconnaissance. Once a token is obtained, exploitation is trivial and requires no authentication. The lack of KEV listing does not diminish the practical exploitability.

Remediation

Update the Grav API plugin to version 1.0.0-rc.16 or later. After patching, conduct a token audit: review server access logs, reverse-proxy logs, and configuration files for any exposed JWT tokens and revoke them. Scan for unauthorized super-admin accounts created during any exploitation window. As a compensating control, restrict API endpoint access by IP address or require additional authentication factors where possible.

Patch guidance

Apply the Grav API plugin update to version 1.0.0-rc.16 or newer as soon as testing allows. Verify the patch against the official Grav repository and the vendor advisory. Test in a non-production environment first to ensure compatibility with your deployment. After deployment, restart the Grav service and confirm that the API plugin is running the patched version. Monitor access logs for anomalies in the hours following the update.

Detection guidance

Search application and proxy logs for GET requests to API endpoints containing ?token= parameters; such requests are highly suspicious and should be investigated. Monitor for unexpected creation of new user accounts, especially with admin or super-admin privileges. Examine JWT tokens in logs for expiration dates and usage patterns inconsistent with normal operation. Alert on any Access-Control-Allow-Origin header values that include wildcard (*) in responses from Grav API endpoints. Use SIEM rules to flag cross-origin API requests from unexpected referrers.

Why prioritize this

This vulnerability merits immediate attention due to its high severity (CVSS 7.5), low attack complexity, and the near-certainty that JWT tokens have already leaked into logs within most organizations. The ability for attackers to create persistent backdoor accounts and exfiltrate sensitive data represents a business-critical risk. Although not yet on the KEV list, the practical exploitability and real-world token exposure make it a top priority for patching.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects high confidentiality impact (unauthenticated access to user and configuration data), no integrity impact in the base score, and no availability impact—though in practice, persistent backdoor access enables further malicious modification. The attack vector is network-based, attack complexity is low, no privileges are required, and no user interaction is necessary beyond passive website visits. The score appropriately captures the severity of a complete authentication bypass paired with cross-origin exploitation.

Frequently asked questions