CVE-2026-63407

This CVE chains two distinct misconfigurations into account takeover: a CorsMiddleware returning `Access-Control-Allow-Origin: *` on authenticated endpoints combined with JWT-based authentication that accepts tokens via client-settable headers. Neither flaw alone is terminal — permissive CORS on public endpoints is benign, and JWT theft requires a separate compromise vector — but together they let any origin's JavaScript abuse a legitimately obtained token. This breaks the protection model that SameSite cookies normally provide against cross-origin authenticated requests, because the attacker controls the Authorization header directly. The CVSS 8.2 score warrants scrutiny. The vulnerability explicitly requires an "attacker-obtained JWT" — meaning this is not an authentication bypass but rather an amplifier of already-compromised credentials. Your actual risk depends entirely on how those JWTs are obtained: if your deployment uses short-lived tokens with proper storage hygiene, the practical impact drops significantly. If tokens are long-lived or exposed through XSS elsewhere in your stack, this CORS misconfiguration becomes the critical pivot that elevates credential theft into active account compromise. The fix landed in 1.0.0-rc.16, which is notable because it shipped as a release candidate rather than a stable release. This raises the question of how widely deployed the vulnerable versions actually are — headless Grav CMS APIs are not ubiquitous, and developers running RCs are typically those building against bleeding-edge tooling in rapid development cycles. That context matters for patch prioritization: this may represent high-actual-risk in a narrow deployment niche rather than a broad attack surface. The deeper pattern worth recognizing: this exact configuration — permissive CORS on bearer-token endpoints — has appeared across enough CVEs since 2019-2021 that it constitutes a recognized vulnerability class. Developers frequently layer JWT authentication onto APIs that were already misconfigured for cross-origin access, then treat the token requirement as a security fix when it's actually just an additional precondition. CORS is a browser constraint, not an authentication mechanism, and conflating those layers is what keeps this pattern alive. The takeaway isn't just "patch this CVE" — it's to audit any JWT-protected REST API for CORS wildcards on authenticated routes, because the combination is more common than the individual flaws suggest.

Reviewed through automated stages and approved by a human before publication.