CVE-2026-75833: Grav API Plugin Open Redirect via Backslash Bypass
The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack) before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo(). The function rejects a literal '//' prefix but does not account for browsers normalizing backslashes to slashes in special (http/https) schemes, so a returnTo value such as '/\evil.com' passes the guard and is later resolved by the browser as the protocol-relative URL '//evil.com'. Following a legitimate OAuth login flow, an attacker-supplied returnTo parameter could redirect an authenticated victim to an attacker-controlled site for post-login phishing. Full browser-side exploitability depends on the admin-next SPA's client-side oauth-callback handler and was not independently verified by the reporter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
getgrav/grav-plugin-api (Grav API Plugin)to a version that resolves this vulnerability.Fixed in 1.0.14 - Configuration
Update/patch the SsoController::sanitizeReturnTo() guard logic in the Grav API plugin to ensure returnTo values that could be normalized by browsers into protocol-relative URLs (e.g., '//evil.com') are rejected.
Grav API Plugin - SsoController::sanitizeReturnTo() returnTo validation = Reject protocol-relative URLs (i.e., values that browsers may normalize to starting with //), including backslash-bypass forms like '/\evil.com'
Event History
Frequently Asked Questions
Which deployments are affected?
The exposed component is the Grav API plugin used in Grav 2.0's admin-next/API stack. Versions before 1.0.14 are affected.
What does an attacker need to exploit this?
An attacker does not need authentication, but must induce a victim to follow a crafted OAuth login flow containing an attacker-controlled returnTo value. The victim must then complete a legitimate OAuth login, after which the redirect can send them to an attacker-controlled site.
What is the practical impact and what uncertainty remains?
The issue is a post-login phishing risk: the victim may be redirected to an attacker-controlled destination after authenticating. Browser-side exploitation also depends on the admin-next SPA's oauth-callback handler, which the reporter did not independently verify.