CVE-2026-58656 Grav API Plugin - Cross-Origin Admin Account Takeover via CORS Wildcard and JWT Query Parameter
Attackers can hijack admin accounts and steal data by exploiting CORS wildcards and JWT tokens passed via URL query parameters in the Grav API plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-58656?
CVE-2026-58656 is a high-severity authentication bypass vulnerability in getgrav grav, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: *, allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website. Attackers who obtain a leaked JWT token from access logs, proxy logs, browser history, or Referrer headers can create persistent backdoor super-admin accounts and exfiltrate sensitive configuration and user data.
Weakness: CWE-598
Which versions are affected by CVE-2026-58656?
How do I fix CVE-2026-58656?
No fix has been published for CVE-2026-58656 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-58656 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58656 exists.
Sources
Also known as GHSA-fx5h-wv8r-5j9q.