CVE-2026-62386
Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-62386 is a high-severity Use of HTTP Request With Sensitive Query String (CWE-598) vulnerability. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 19th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-45086
Vulnerability Data
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractBearerToken fallback). Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via…
more
the Referer header, stored in browser history, and captured by upstream proxy and CDN logs, exposing valid admin access tokens. A leaked token grants unauthorized API access, including reading configuration and user data, creating admin accounts, modifying system settings, and deleting pages.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables exposure of JWT tokens in logs/URLs (T1552 Unsecured Credentials, esp. .001) and subsequent unauthorized API access via valid tokens (T1078 Valid Accounts).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Requires protection of authenticators during storage and transmission, directly prohibiting exposure of JWT tokens via URL query parameters that leak into logs, Referer headers, and browser history.
Mandates cryptographic protection and integrity for sensitive data in transit, preventing use of query-string tokens that are inherently visible to intermediaries and logs.
Establishes secure remote-access mechanisms and token-handling requirements, eliminating the insecure ?token= fallback used by the Grav API plugin.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent embedding sensitive data in query strings as part of input-handling and data-flow design.
HTTPS encryption protects query strings in transit but does not address the root design flaw of placing sensitive data in URLs.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect sensitive data leakage via query strings.
DLP solutions can detect and block sensitive data in URLs.
Network security controls can enforce HTTPS and block sensitive data in URLs.
Application security requirements should mandate avoiding sensitive data in query strings.
Secure architecture principles discourage exposing sensitive data in URLs.
Secure coding standards directly prohibit placing secrets in query parameters.