CVE-2026-63408High· 7.5▾ TwilightGrav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter o…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
0.4% → 0.5%
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints. Request URLs consequently expose valid access tokens through Apache, proxy, and CDN logs, browser history, and Referer headers, allowing a party with access to those records to reuse the token with the owner's API privileges. This issue is fixed in version 1.0.0-rc.16.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113669Medium· 5.3ApostropheCMS: Cross-domain session token in URL confers session takeover
CVE-2026-107370Medium· 5.3When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request
CVE-2026-108808Low· 2.6A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0
CVE-2026-107807High· 8.8Nginx UI is a web user interface for the Nginx web server
CVE-2026-76179Critical· 9.8Ebyte NA111-M Use of GET Request Method With Sensitive Query Strings
CVE-2025-62317Low· 2.6HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters