Grav API Plugin EUVD-2026-60597

Exploitation requires a Grav installation running the admin-next SPA with the grav-plugin-api plugin at a version prior to 1.0.14 and SSO/OAuth login functionality enabled and reachable. From the attacker's side, no authenticated access to the target Grav instance is needed - the attacker only needs to deliver a crafted login URL to a victim. However, the victim must already hold a valid Grav session or complete a fresh OAuth login (UI:P per the CVSS 4.0 vector), meaning the post-redirect phishing works only against users who actively authenticate via the SSO flow. Full exploitability additionally depends on the admin-next SPA's client-side OAuth-callback handler actually issuing the redirect from the server-supplied returnTo value, a behavior the original reporter explicitly did not independently verify. Classic Grav installations without the API plugin or without SSO/OAuth configured are not affected.

The CVSS 4.0 score of 8.6 with VC:H/VI:H/VA:H appears significantly elevated for a classical open redirect and likely reflects worst-case downstream phishing consequences (credential theft, session hijacking) rather than direct system compromise achievable by the vulnerability alone. The PR:L metric in the provided vector suggests low-privilege attacker access, though for a crafted-URL delivery model the attacker typically requires no privileges of their own - the victim must be authenticated (UI:P). There is no CISA KEV listing and no public proof-of-concept identified at time of analysis, meaning confirmed active exploitation is absent. EPSS data was not provided, limiting probabilistic risk quantification. A key uncertainty flagged in the description itself is that full exploitability depends on the admin-next SPA's client-side OAuth-callback handler behavior, which was not independently verified - this introduces meaningful doubt about real-world reproducibility. Real-world priority is moderate-to-low: the technique is conceptually simple but requires user interaction and targets a relatively niche deployment (Grav 2.0 admin-next), and the impact is a redirect, not direct code execution or data exfiltration.

An attacker crafts a Grav OAuth login URL with the returnTo parameter set to '/\attacker.com/harvest' and delivers it via phishing email or link injection to a Grav administrator. The victim clicks the link, completes the legitimate SSO login flow, and is immediately redirected - because the browser normalizes the backslash to a forward slash - to '//attacker.com/harvest', an attacker-controlled credential-harvesting page styled to mimic the Grav admin interface. No public proof-of-concept code exists at time of analysis, but the backslash-normalization behavior is a well-known browser characteristic requiring no specialized tooling to exploit.