Open Redirect Vulnerability in Grav API Plugin from Grav

CVE-2026-75833

What is CVE-2026-75833?

The Grav API plugin prior to version 1.0.14 contains an open redirect vulnerability in its SsoController::sanitizeReturnTo() function. This flaw allows attackers to exploit the parameter used in legitimate OAuth login flows. Specifically, it fails to adequately sanitize URLs containing a backslash, enabling an attacker to redirect authenticated users to malicious sites, such as '//evil.com', which are interpreted as valid by the browser. This vulnerability poses a significant risk for users who may be unknowingly led to phishing attempts post-login.

References