# CVE-2026-75833: Grav API plugin open redirect via backslash bypass

Source: https://junglewise.ai/threats/cve-2026-75833-grav-api-plugin-open-redirect-via-backslash-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75833 · Severity: medium · CVSS 4.2 · Published 2026-08-18

The Grav API plugin, a core authentication component bundled with Grav 2.0, contains a flaw in its login redirect validation. An attacker can craft a malicious link that, after a user completes legitimate login, redirects them to an attacker-controlled site where a phishing page can steal credentials or session data. The attack exploits how web browsers normalize backslashes in URLs, bypassing the plugin's safety check.

Technologies: [Grav API Plugin](https://junglewise.ai/threats/technologies/api-plugin). Vendors: [Grav](https://junglewise.ai/threats/vendors/grav).

## Quick answers

**Is CVE-2026-75833 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75833 being exploited in the wild.

**How severe is CVE-2026-75833?** Medium severity, with a CVSS score of 4.2, published 18 August 2026.

**Which products and versions are affected?** Grav API Plugin before 1.0.14.

**Is there a fix for CVE-2026-75833?** A patch was published on 2026-08-03: patched version 1.0.14 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75833 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-75833?** Check whether you run Grav API Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an open redirect (CWE-601) in SsoController::sanitizeReturnTo(), which validates the returnTo parameter consumed by OAuth start() and callback() flows. The function blocks URLs starting with '//' but fails to account for WHATWG URL Standard backslash normalization: in http/https schemes, a browser treats backslashes identically to slashes, so '/\evil.com' (which passes validation) is resolved as '//evil.com' (a protocol-relative URL to an external host). The attack requires user interaction (clicking an attacker-supplied link and completing legitimate OAuth login) but does not require prior authentication or system access. An attacker can redirect freshly-authenticated users to a phishing site, leveraging the trust established by successful login. The vulnerability is fixed in version 1.0.14; affected versions are before 1.0.14.

## Affected products

- Grav API plugin before 1.0.14

## Timeline

- 2026-08-18: disclosed
- 2026-08-03: patched: patched version 1.0.14 released

## References

- [https://github.com/getgrav/grav/security/advisories/GHSA-x72c-4jc4-8rh6](https://github.com/getgrav/grav/security/advisories/GHSA-x72c-4jc4-8rh6)
- [https://www.vulncheck.com/advisories/grav-api-plugin-open-redirect-via-backslash-bypass](https://www.vulncheck.com/advisories/grav-api-plugin-open-redirect-via-backslash-bypass)

## Related threats

- [Grav API plugin session validation bypass in disabled accounts](https://junglewise.ai/threats/cve-2026-109320-the-grav-api-plugin-grav-plugin-api-before-1-0-36-contains-an)
- [Grav API Plugin password reset link spoofing via Host header](https://junglewise.ai/threats/cve-2026-86196-grav-api-plugin-password-reset-link-spoofing-via-host-header)
- [Grav API Plugin scope cap bypass in page permissions](https://junglewise.ai/threats/cve-2026-80204-grav-api-plugin-scope-cap-bypass-in-page-permissions)
- [Grav API plugin server-side request forgery in webhook delivery](https://junglewise.ai/threats/cve-2026-56708-grav-api-plugin-server-side-request-forgery-in-webhook-delivery)
- [Grav API Plugin privilege escalation in API key management](https://junglewise.ai/threats/cve-2026-64852-grav-api-plugin-privilege-escalation-in-api-key-management)