CVE-2026-53654
Received Received - Intake

Grav Login Plugin Phishing Redirect via TwoFA Cancel

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofa_cancel task accepts a client-controlled _redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute() applies the field when taskTwofa_cancel() sets no redirect, and Grav::getRedirectResponse() accepts the target through Uri::isExternal(), enabling phishing redirects from a trusted Grav host. This issue is fixed in version 3.8.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-53654
EUVD
EUVD-2026-62532

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav_plugin_login to 3.8.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an open redirect issue in the Grav Login plugin versions 3.8.4 and earlier. It allows unauthenticated attackers to manipulate the twofa_cancel task by providing a client-controlled _redirect parameter without proper validation. The system then redirects users to an external malicious URL via a 303 HTTP response, enabling phishing attacks.

Detection Guidance

Check Grav CMS versions prior to 3.8.5 for the Login plugin. Inspect POST requests to the twofa_cancel task for unsanitized _redirect parameters pointing to external domains. Monitor HTTP 303 responses with Location headers to unexpected external URLs.

Impact Analysis

This vulnerability could allow attackers to trick users into visiting malicious websites by redirecting them from a trusted Grav host. Users might unknowingly enter sensitive information on fake login pages, leading to potential account compromise or data theft. The attack requires no authentication but is limited to POST requests.

Compliance Impact

This vulnerability enables phishing redirects from a trusted Grav host, which could lead to unauthorized data exposure or manipulation. Such attacks may violate GDPR's requirement for secure data processing and HIPAA's safeguards for protected health information by exposing users to malicious sites that could harvest credentials or sensitive data.

Mitigation Strategies

Upgrade the Grav Login plugin to version 3.8.5 or later. Ensure all redirects in the twofa_cancel task are validated server-side and require a valid nonce for execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53654. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart