CVE-2026-53654: Grav: Unauthenticated open redirect via login twofa_cancel _redirect
Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofacancel task accepts a client-controlled redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute() applies the field when taskTwofacancel() sets no redirect, and Grav::getRedirectResponse() accepts the target through Uri::isExternal(), enabling phishing redirects from a trusted Grav host. This issue is fixed in version 3.8.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav (Login plugin: twofa_cancel)to a version that resolves this vulnerability.Fixed in 3.8.5
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote requester can exploit it by supplying a client-controlled _redirect value to the Login plugin's twofa_cancel task. No nonce is required.
What redirect targets are accepted?
External http and https URLs, as well as protocol-relative targets, can be used as Location redirect destinations. This permits redirects from a trusted Grav host to an attacker-controlled site.
Are installations affected by default?
The issue is in the Grav Login plugin behavior prior to version 3.8.5. The provided data does not identify any additional configuration prerequisite.
How can I determine whether an instance is affected?
Check the installed Login plugin version. Versions prior to 3.8.5 are affected; version 3.8.5 contains the fix.