CVE-2026-75833
Received Received - Intake

Open Redirect in Grav API Plugin

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack) before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo(). The function rejects a literal '//' prefix but does not account for browsers normalizing backslashes to slashes in special (http/https) schemes, so a returnTo value such as '/\evil.com' passes the guard and is later resolved by the browser as the protocol-relative URL '//evil.com'. Following a legitimate OAuth login flow, an attacker-supplied returnTo parameter could redirect an authenticated victim to an attacker-controlled site for post-login phishing. Full browser-side exploitability depends on the admin-next SPA's client-side oauth-callback handler and was not independently verified by the reporter.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-75833
EUVD
EUVD-2026-60597

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
getgrav grav From 0 (inc) to 1.0.14 (exc)
getgrav grav-plugin-api to 1.0.14 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an open redirect weakness in the Grav API plugin's SsoController::sanitizeReturnTo() function. The function checks for a literal '//' prefix but fails to account for browsers normalizing backslashes to slashes. This allows an attacker to bypass the guard using a returnTo value like '/\evil.com', which the browser resolves as '//evil.com'.

Detection Guidance

Check Grav CMS installations for the vulnerable plugin version. Inspect web server logs for suspicious OAuth callback URLs containing backslashes or unusual returnTo parameters like '/\evil.com'. Use tools like curl to test endpoints for open redirect behavior by sending crafted returnTo values.

Impact Analysis

An attacker could manipulate the returnTo parameter in a legitimate OAuth login flow to redirect an authenticated victim to a malicious site after login. This could lead to post-login phishing attacks where the victim is tricked into revealing sensitive information or credentials.

Compliance Impact

This vulnerability enables open redirect attacks that could lead to phishing or unauthorized data access. For GDPR, it may violate Article 32 (security of processing) by exposing user sessions to attackers. HIPAA could be impacted if patient data is exposed during redirected sessions. Compliance may require patching to mitigate risks.

Mitigation Strategies

Update the Grav API plugin to version 1.0.14 or later. Review and restrict OAuth callback handlers to validate returnTo parameters strictly. Monitor network traffic for unexpected redirects post-authentication. Consider disabling the plugin if unused.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75833. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart