CVE-2026-88897
Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers
CVSS
5.9
Medio
EPSS
0.3%
p24
KEV
—
Exploit Today
7
0-100
Publicado: 10 sept 2026 · Última mod.: 10 sept 2026 · CWE-598
Sin historial EPSS suficiente todavía.
Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access.
- github.comhttps://github.com/flextype/flextype
- github.comhttps://github.com/flextype/flextype/blob/v1.0.0-alpha.3/src/flextype/core/Endpoints/Api.php
- github.comhttps://github.com/flextype/flextype/issues/598
- www.vulncheck.comhttps://www.vulncheck.com/advisories/flextype-cms-through-1.0.0-alpha.3-api-token-exposure-via-query-string
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-616145.9 MED20.7%
——6SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a `?token=` URL query parameter as a fallback to the `X-API-TOKEN` header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser history, and HTTP Referer headers sent to third-party origins. Version 3.0.1 fixes the issue.2dCVE-2026-821815.5 MED5.4%
——2Medical Practice Management System developed by Le-yan has a Sensitive Data in URL vulnerability. Unauthenticated remote attackers can obtain sensitive information via victim's browser history or log files.15dCVE-2026-761799.8 CRÍ36.7%
——11An improper protection of authentication tokens vulnerability exists in
certain Ebyte gateway products. Authentication tokens used by the web
management interface are insufficiently protected during client-side
session handling, which may allow an attacker with access to exposed
session information to obtain and reuse a valid token. Successful
exploitation could allow an attacker to impersonate an authenticated
user and gain unauthorized access to device management functionality.12dCVE-2026-634087.5 ALT29.3%
——9Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints. Request URLs consequently expose valid access tokens through Apache, proxy, and CDN logs, browser history, and Referer headers, allowing a party with access to those records to reuse the token with the owner's API privileges. This issue is fixed in version 1.0.0-rc.16.3dCVE-2026-748809.8 CRÍ23.3%
——7openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.11dCVE-2026-668326.5 MED17.3%
——5When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context.11d