The Grav API plugin accepts JWT tokens through the ?token= query parameter and replies with Access‑Control‑Allow‑Origin: *, giving an attacker the ability to send authenticated requests from any malicious origin. This vulnerability stems from improper handling of JWTs in the query string, a flaw classified as CWE-598. If a JWT is leaked – from logs, browser history, or Referrer headers – create a persistent super‑admin account and retrieve sensitive configuration and user data.

GetGrav Grav API plugin version before 1.0.0‑rc.16 is affected. The issue applies to all deployments of GetGrav Grav that use the plugin without the correction.

The CVSS score of 8.7 indicates high severity, and the EPSS score of <1% indicates a low but non‑zero probability of exploitation. The vulnerability is not yet listed in the CISA KEV catalog. Attackers can exploit the flaw by loading a malicious website that makes cross‑origin API calls to the target. Since the plugin authorizes the token without verifying it is not in the query string, any attacker who obtains a valid token can effectively control the account.