CVE-2026-63407

The record

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin CorsMiddleware returns Access-Control-Allow-Origin: * and permissive OPTIONS responses for authenticated /api/v1 endpoints. JavaScript from any origin can submit an attacker-obtained JWT through the Authorization or X-API-Token header, read the authenticated response, and perform write operations with the token owner's privileges, enabling data exfiltration and account modification. This issue is fixed in version 1.0.0-rc.16.

Affected packages

Related vulnerabilities

• CVE-2026-53649 Joro is a web exploitation framework. CWE-942
• CVE-2025-61163 Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain… CWE-942
• CVE-2026-18676 The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and… CWE-942
• CVE-2026-65310 ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected… CWE-942
• CVE-2026-21761 HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. CWE-942
• CVE-2026-59148 Mockoon provides way to design and run mock APIs. CWE-942
• CVE-2026-59726 Ruflo is an agent meta-harness for Claude Code and Codex. CWE-942
• CVE-2026-56458 HCL DevOps Deploy uses Cross-Origin Resource Sharing (CORS) which could allow an attacker… CWE-942