CVE-2026-58656 - Grav API Plugin - Cross-Origin Admin Account Takeover via CORS Wildcard and JWT Query Parameter
CVE ID :CVE-2026-58656 Published : July 8, 2026, 2:17 p.m. | 57 minutes ago Description :Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: *, allowing unauthenticated attackers to make fully authenticated...