EUVD-2026-60597
GHSA-chr5-7vjc-3p97
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker needs no privileges to craft the URL; victim must actively follow it (UI:R); redirect impact limited to phishing-driven credential exposure (C:L), with no direct integrity or availability consequence.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack) before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo(). The function rejects a literal '//' prefix but does not account for browsers normalizing backslashes to slashes in special (http/https) schemes, so a returnTo value such as '/\evil.com' passes the guard and is later resolved by the browser as the protocol-relative URL '//evil.com'. Following a legitimate OAuth login flow, an attacker-supplied returnTo parameter could redirect an authenticated victim to an attacker-controlled site for post-login phishing. Full browser-side exploitability depends on the admin-next SPA's client-side oauth-callback handler and was not independently verified by the reporter.
AnalysisAI
Open redirect in the Grav API plugin (grav-plugin-api) before 1.0.14, bundled with Grav 2.0's admin-next/API stack, allows post-login phishing via a backslash normalization bypass in SsoController::sanitizeReturnTo(). An attacker who can send a crafted OAuth login URL to an authenticated admin victim can supply a returnTo value such as '/\evil.com' that passes the guard rejecting '//' prefixes but is silently normalized by the browser into the protocol-relative URL '//evil.com', redirecting the victim to an attacker-controlled site immediately after a legitimate login. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a Grav installation running the admin-next SPA with the grav-plugin-api plugin at a version prior to 1.0.14 and SSO/OAuth login functionality enabled and reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.6 with VC:H/VI:H/VA:H appears significantly elevated for a classical open redirect and likely reflects worst-case downstream phishing consequences (credential theft, session hijacking) rather than direct system compromise achievable by the vulnerability alone. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a Grav OAuth login URL with the returnTo parameter set to '/\attacker.com/harvest' and delivers it via phishing email or link injection to a Grav administrator. The victim clicks the link, completes the legitimate SSO login flow, and is immediately redirected - because the browser normalizes the backslash to a forward slash - to '//attacker.com/harvest', an attacker-controlled credential-harvesting page styled to mimic the Grav admin interface. … |
| Remediation | Upgrade the Grav API plugin (grav-plugin-api) to version 1.0.14 or later, which contains the corrected sanitizeReturnTo() validation logic; the vendor advisory at https://github.com/getgrav/grav/security/advisories/GHSA-x72c-4jc4-8rh6 should be consulted for upgrade instructions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, enumerate all Grav 2.0 deployments and identify current grav-plugin-api versions; alert administrators to watch for unexpected post-login redirects and disable OAuth temporarily if possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today