Executive brief
The Grav API plugin, a core authentication component bundled with Grav 2.0, contains a flaw in its login redirect validation. An attacker can craft a malicious link that, after a user completes legitimate login, redirects them to an attacker-controlled site where a phishing page can steal credentials or session data. The attack exploits how web browsers normalize backslashes in URLs, bypassing the plugin's safety check.
Technical details
The vulnerability is an open redirect (CWE-601) in SsoController::sanitizeReturnTo(), which validates the returnTo parameter consumed by OAuth start() and callback() flows. The function blocks URLs starting with '//' but fails to account for WHATWG URL Standard backslash normalization: in http/https schemes, a browser treats backslashes identically to slashes, so '/\evil.com' (which passes validation) is resolved as '//evil.com' (a protocol-relative URL to an external host). The attack requires user interaction (clicking an attacker-supplied link and completing legitimate OAuth login) but does not require prior authentication or system access. An attacker can redirect freshly-authenticated users to a phishing site, leveraging the trust established by successful login. The vulnerability is fixed in version 1.0.14; affected versions are before 1.0.14.
Affected products
- Grav API plugin before 1.0.14
Timeline
- 2026-08-18: disclosed
- 2026-08-03: patched: patched version 1.0.14 released